Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › Hardening › Network Exposure

Network Exposure

Status: Operator recommendation plus a few product-enforced bind/auth rules. Not a certified perimeter standard.Audience: deployment engineer

Product-enforced

  • /metrics admin-gated when enabled
  • Login rate limiter on /api/v1/auth/login
  • Agent register rate limiter
  • CORS wildcard blocked in TLS/production (example requires explicit origins)
  • trusted_client_ip default off; if enabled, CIDRs must be exact /32 or /128 and max_hops must be 1
  • Hosting Agent has no CAP_NET_ADMIN / CAP_NET_RAW

Operator recommendation

  • Do not leave Manager on 0.0.0.0:8443 reachable from the Internet without an independent ACL.
  • Point Agents at an internal URL.
  • Keep Agent metrics on 127.0.0.1.
  • /health/live and /health/ready are unauthenticated — expose them only to the load balancer network.
  • Do not publish lab hostnames. Do not copy Documentation= URLs from Hosting units.

Not a public product

Cluster gRPC (example 50051), edge mode, Kubernetes Services.