Security and ports
UMKIM v0.1.0 is a homelab / small-fleet reference stack, not a certified product.
Assumptions
Section titled “Assumptions”| Assumption | Detail |
|---|---|
| Operators | Trusted; have SSH and Ansible vault access |
| Internet (WAN) | Untrusted — only required ports on hub |
| WireGuard overlay | Trusted management plane (wireguard_overlay_cidr) |
| Hub | Single point of failure for the control plane |
| Spokes | May keep workloads running if hub is down (fleet_autonomous) |
Exposed ports (hub WAN)
Section titled “Exposed ports (hub WAN)”| Port | Protocol | Service |
|---|---|---|
| 22 | TCP | SSH |
| 80 | TCP | Hub Traefik HTTP |
| 443 | TCP | Hub Traefik HTTPS |
| 51820 | UDP | WireGuard |
Management NodePorts (console, LLDAP UI, LiteLLM, etc.) stay off the WAN by default — reach them over WireGuard.
Security contact: security@umkim.com.