network_security/NOTES.md

The principle to build around Fail closed. A new service should be protected by default, not by remembering. Right now .lab is open-by-default — that's what made the console bypass matter. Tier 1 — do these first (highest value, least work)

1. Move admin UIs to Tailscale, keep .lab for public sites only. You already have Tailscale on .13 , .27 , .51 and the phone. Admin dashboards (console, Portainer, Gitea, Paperclip) don't need the public internet — you get remote access anyway, with no exposure. Zero new software. This alone removes most of your attack surface.
2. Put one auth layer in front of the whole wildcard. Caddy forward-auth → Authelia (or Authentik). Every *.lab host goes through one policy: SSO, 2FA, default-deny, with an explicit allowlist for genuinely public sites. Then "I forgot to add auth" can't happen.
3. Add CrowdSec. It tails your Caddy and sshd logs, detects scans like the one you just saw, and auto-bans via a Caddy bouncer. You already accept scanning — this turns it from noise into blocked traffic, and gives you a dashboard of who's probing. Tier 2 — stop the two failure modes you've already hit
4. gitleaks + trufflehog. You had a key leak on Gitea. gitleaks as a pre-commit hook stops new leaks; trufflehog scans existing repos and history for what's already there. Cheapest possible fix for a problem that already cost you once.
5. semgrep. SAST for your own code — exactly the class of bug found today. It runs in seconds, has auth/security rulesets, and fits a pre-commit or CI step.
6. trivy. Scans your container images and filesystems for known CVEs. With ~50 containers you're running a lot of images you never inspect. Tier 3 — worth doing, not urgent
7. nuclei — run your own scans against .lab so you find the issues before the bots do. Also tells you what's actually exposed.
8. A correct-by-default auth helper + one test. For your FastAPI apps: a shared dependency that verifies the password, and a test that asserts valid username + wrong password → 401. That exact test would have caught today's bug on the first run. What you already have • npq, sfw, vet — npm supply-chain (on .13 ). • Tailscale — underused; see Tier 1 item 1. • Caddy — the natural place for forward-auth and the CrowdSec bouncer.