Security and ports
This content is for 0.1.0. Switch to the latest version for up-to-date documentation.
Unsupported proof of concept. UMKIM v0.1.0 is not production-certified or supported. Review every playbook, image, secret, firewall rule, and external endpoint before use.
The hub is a control-plane single point of failure. Operators with SSH, vault, or Kubernetes administrative access are trusted by the model. Treat the internet as untrusted and the WireGuard overlay as a restricted management network.
Hub WAN exposure
Section titled “Hub WAN exposure”| Port | Protocol | Service |
|---|---|---|
| 22 | TCP | SSH |
| 80 | TCP | Hub Traefik HTTP |
| 443 | TCP | Hub Traefik HTTPS |
| 51820 | UDP | WireGuard |
Keep management NodePorts, Kubernetes APIs, registry administration, and overlay-only services off the WAN. Reach management services through WireGuard and use least-privileged authenticated access.
FLEET_PROFILE=production enables stricter configuration checks, but does not
make this release production-safe or supported. Run the preflight with that
value explicitly set and use an encrypted vault.
Report vulnerabilities through a private GitHub Security Advisory. Do not post exploit details, credentials, bootstrap bundles, or private infrastructure details in public issues.