Initial: network security spec (fail-closed, forward-auth, CrowdSec, scanning)

NOTES.md

@@ -0,0 +1,41 @@
+The principle to build around
+Fail closed. A new service should be protected by default, not by remembering. Right now 
+.lab
+ is open-by-default — that's what made the console bypass matter.
+Tier 1 — do these first (highest value, least work)
+1. Move admin UIs to Tailscale, keep 
+.lab
+ for public sites only.
+You already have Tailscale on 
+.13
+, 
+.27
+, 
+.51
+ and the phone. Admin dashboards (console, Portainer, Gitea, Paperclip) don't need the public internet — you get remote access anyway, with no exposure. Zero new software. This alone removes most of your attack surface.
+2. Put one auth layer in front of the whole wildcard.
+Caddy forward-auth → Authelia (or Authentik). Every *.lab host goes through one policy: SSO, 2FA, default-deny, with an explicit allowlist for genuinely public sites. Then "I forgot to add auth" can't happen.
+3. Add CrowdSec.
+It tails your Caddy and sshd logs, detects scans like the one you just saw, and auto-bans via a Caddy bouncer. You already accept scanning — this turns it from noise into blocked traffic, and gives you a dashboard of who's probing.
+Tier 2 — stop the two failure modes you've already hit
+4. gitleaks + trufflehog.
+You had a key leak on Gitea. gitleaks as a pre-commit hook stops new leaks; trufflehog scans existing repos and history for what's already there. Cheapest possible fix for a problem that already cost you once.
+5. semgrep.
+SAST for your own code — exactly the class of bug found today. It runs in seconds, has auth/security rulesets, and fits a pre-commit or CI step.
+6. trivy.
+Scans your container images and filesystems for known CVEs. With ~50 containers you're running a lot of images you never inspect.
+Tier 3 — worth doing, not urgent
+7. nuclei — run your own scans against 
+.lab
+ so you find the issues before the bots do. Also tells you what's actually exposed.
+8. A correct-by-default auth helper + one test.
+For your FastAPI apps: a shared dependency that verifies the password, and a test that asserts valid username + wrong password → 401. That exact test would have caught today's bug on the first run.
+What you already have
+•
+npq, sfw, vet — npm supply-chain (on 
+.13
+).
+•
+Tailscale — underused; see Tier 1 item 1.
+•
+Caddy — the natural place for forward-auth and the CrowdSec bouncer.