Initial OpenWrt RMM implementation

docs/security.md

@@ -0,0 +1,59 @@
+# Security Notes
+
+This project is still an MVP. Treat every enrolled router as a privileged remote execution target and run the server only on trusted networks until the remaining hardening work is complete.
+
+## Trust Model
+
+- The server is the control plane.
+- The OpenWrt agent is a privileged device-side worker.
+- Browser operators authenticate with a username/password and a signed `HttpOnly` session cookie.
+- API automation can authenticate with `RMM_OPERATOR_TOKEN`.
+- Devices authenticate with a per-device bearer token issued during enrollment.
+- Enrollment currently uses a shared enrollment token and should be considered bootstrap-only.
+
+## Current Controls
+
+- Agent traffic is outbound polling, so routers do not need inbound firewall openings.
+- Devices receive unique bearer tokens after enrollment.
+- Operator APIs accept a signed browser session or an operator bearer token.
+- Server and agent both enforce command allowlists.
+- UCI operations are limited to allowlisted config packages: `network`, `wireless`, `dhcp`, `firewall`, and `system`.
+- Command output is redacted for sensitive keys before storage and display.
+- Command lifecycle has retries, expiry, cancellation, and result rejection for cancelled or expired commands.
+- UCI preview can show a diff without leaving staged changes.
+- UCI commit-confirmed can restore the latest local backup if the router loses server reachability after commit.
+- Basic audit events are recorded for operator command creation and cancellation.
+
+## MVP Risks
+
+- Tokens are stored in SQLite as bearer credentials and are not yet hashed.
+- The enrollment token is shared and long-lived unless operators rotate it manually.
+- There is no RBAC, organization isolation, or per-command approval policy.
+- There are no rate limits or replay protection.
+- Commands are not signed.
+- TLS termination is not handled by the application. Use a reverse proxy with HTTPS when exposing the server beyond localhost or a lab LAN.
+
+## Operational Guidance
+
+- Run the server behind HTTPS and restrict inbound access to trusted operator networks.
+- Use a high-entropy `RMM_OPERATOR_TOKEN` and enrollment token.
+- Use a high-entropy operator password and `RMM_SESSION_SECRET`.
+- Set `RMM_COOKIE_SECURE=true` behind HTTPS.
+- Rotate the enrollment token after initial device onboarding.
+- Keep the SQLite database private and backed up.
+- Prefer `uci_preview` and `uci_backup` before `uci_set` or `uci_commit`.
+- Use `uci_commit_confirmed` for network changes that can break connectivity.
+- Review command history and audit events after configuration changes.
+
+## Next Hardening Work
+
+- Hash device tokens in storage.
+- Add device token rotation and revocation.
+- Replace shared enrollment with single-use enrollment grants.
+- Add request IDs and structured logs.
+- Add rate limits for enrollment, heartbeat, command result, and operator APIs.
+- Add replay protection or signed device requests.
+- Add command approval policies for reboot, UCI commit, restore, package install, and remote access.
+- Add RBAC for operators.
+- Add organization or fleet isolation before multi-tenant use.
+- Add mTLS or signed device tokens for production fleets.