Security & permissions
PAUIOps reduces routine SSH exposure and accidental cross-project access. It does not claim complete isolation, zero risk, or a replacement for server hardening.
Every user receives a global role, selected project assignments, and per-project read, write, or none access. The role controls which areas open; the assignment controls what the user can do inside each repository. This replaces a shared root shell for routine work, not administrator ownership of the server.
Manager runs as a non-root service identity. It reaches Docker through the socket group and elevates only exact approved Dashboard commands when deliberately configured. Docker group membership is highly privileged on Linux. Enabling Dashboard sudo also relaxes part of the service sandbox, so the fixed allowlist and protected environment remain essential.
Administrator clone injects an HTTPS header for one invocation. Raw Git in the Manager administrator shell may use the runtime user’s startup-seeded credential store. App commits receive author name and email per invocation. Remote authentication and commit identity never substitute for one another, and safe.directory is scoped to the active repository.
Structured PAUIOps-owned Git runners, private clone, and bounded helper setup remove PAUIOPS_*, deprecated DOCKER_MGR_*, and SUDO_PASSWORD before launching Git or hooks. A raw or interactive terminal inherits the Manager service environment before it invokes Git, scripts, helpers, or repository hooks. Terminal access and executable hooks are trusted-code boundaries.
Manager validates an absolute project root, rejects protected system paths, verifies traversal and writability, and applies symlink-aware checks to create, rename, read, write, and delete operations. Project paths must remain below the managed root; an inaccessible root is fatal because file work would be unsafe.
bcrypt protects passwords, failed logins throttle after 10 failures in 15 minutes, and unknown accounts receive uniform responses. Optional six-digit login OTP is separate from the eight-character, 15-minute recovery code. Password reset revokes every session and token; logout revokes both forms of the same login session. Center sessions stay separate per Manager.
Forgot: 5 requests per email/IP in 15m · Reset: 15 submissions in 15m · Challenge: 5 wrong-code attempts
The browser defaults to same-origin access. Exact CORS and WebSocket origins can be added deliberately. Session cookies are HTTP-only and SameSite Strict, becoming Secure over direct TLS or explicitly trusted HTTPS proxy headers. Proxy headers are ignored unless PAUIOPS_TRUST_PROXY_HEADERS=true. Every public endpoint should use HTTPS.
Destructive actions require confirmation. Commands have timeouts and process-group cancellation. Startup validation separates fatal conditions from optional feature warnings. Diagnostics can run read-only, shutdown drains work, installers are idempotent, and verified Manager binary upgrades restore the previous executable when health validation fails.
PAUIOps reduces routine SSH exposure and narrows application workflows. It does not remove the need for server hardening, backups, TLS, network controls, secret rotation, and administrator oversight.
Start with the hosted operations center
