Security
The installation profile controls how a Host exposes management services. Use public when the management address is reachable from untrusted networks and private only for an appropriately trusted network. Before changing exposure, retain an out-of-band console and identify every administrator, Pool peer and remote integration that needs access.
Review exposure
Public is the default profile. Its administration endpoint normally uses TCP 8443. xapi and Pool traffic on 443 are restricted to Pool Hosts and configured administration sources; private-profile 443 also serves the dashboard. The public profile does not automatically finish Edge provisioning or transfer ownership of the NIC.
The profile is read from /etc/conf.d/hv. Agent exposure settings live in /etc/hv/agent.toml. Review those through your deployment's configuration procedure, then restart the affected services and reload the firewall when applying a change. Do not confuse a restricted xapi endpoint with an unreachable dashboard: they are different paths and may use different ports.
SSH is disabled unless enabled during installation or later administration. Keys-only access is the default, but the answer schema also permits explicit password login. Therefore inspect the actual SSH configuration instead of assuming every installed Host is keys-only. When enabled, public-profile SSH is not automatically restricted to the administrator WireGuard link.
Protect administration
- Verify TLS identity before signing in or registering another Pool.
- Use Project and Silo roles for routine work and limit Fleet administration.
- Enroll administrator second factors, preserve recovery codes and then consider requiring them through policy.
- Create narrowly scoped automation tokens and revoke unused ones.
- Preserve console access before changing management routes, firewall settings or provider admission.
The optional WireGuard admin link provides recovery access independently of the dashboard. Protect peer configuration and remove access when an operator no longer needs it. Pool mesh keys remain on their Hosts; do not copy them into an administrator manual or support report.
Verify the controls
Check rc-service hv-firewall status and rc-status after boot or a firewall change. A failure to load the packaged firewall can leave a Host unfiltered; service failure is not a protected state. Test both the intended administration path and the refusal of unintended access from the appropriate networks.
Review Audit log after role, repository and infrastructure changes. Independent audit anchors help detect changes that a restored database alone cannot reveal. Keep backups and recovery material in a separate failure domain and verify restore procedures.
Common problems
An unexpected 404 on public xapi may mean the caller's source is not admitted. A sign-in 429 means rate limiting; correcting the input and waiting is preferable to disabling limits. If a reverse proxy is used, trust forwarded client addresses only from that controlled proxy and restrict direct backend access. Avoid broadening global roles or network access merely to make one integration work; identify its exact action and endpoint first.