From 5c8b72c04e1df630446ecf3bbfdd5c21922d9296 Mon Sep 17 00:00:00 2001 From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com> Date: Mon, 31 Aug 2026 00:01:01 +0000 Subject: [PATCH] docs(roadmap): track authenticating the ingest ports (#182) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #70 closed with Alertmanager fixed and Prometheus and Loki left published and unauthenticated, because `oracle`'s agent pushes to them and has no other path. That residual is recorded in SECURITY.md, but the work to retire it was not tracked anywhere — and this file is where outstanding work lives. Placed after the two SNMP items so those stay adjacent, and above the egress question, which is a decision rather than a known task. Co-Authored-By: Claude Opus 5 --- docs/roadmap.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/roadmap.md b/docs/roadmap.md index d31c960..af59aaf 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -22,6 +22,13 @@ issues intact. Nothing was summarised away. - **[#85](https://github.com/Gerrrt/HomeLab/issues/85) Move to SNMPv3 authPriv.** Three of four devices can. The MokerLink switch cannot, which is the blocker for doing it uniformly. +- **[#182](https://github.com/Gerrrt/HomeLab/issues/182) Authenticate the + Prometheus and Loki ingest ports.** Both are published and unauthenticated, so + anything that can route to `10.0.99.20` can read every metric and log line, + inject metrics and delete log ranges. They stay published because `oracle`'s + agent pushes to them and has no other path, which is why #70 could close + Alertmanager and not these. Firewall default-deny is the whole control. + Accepted residual, recorded in `SECURITY.md`. - **[#86](https://github.com/Gerrrt/HomeLab/issues/86) Decide whether the lab VLAN needs egress filtering** — before the playground exists, not after.