Orbtrace
ENTR
Talk to sales
Self-host

Security hardening

The checklist to run before Orbtrace faces anything beyond your laptop — TLS, secrets, network exposure, authentication posture, actuator surface, and the audit trail.

The quickstart defaults are tuned for a local demo, not for a box on a network. Run this checklist before anyone else can reach the instance. It's ordered by impact.

  1. 1

    Don't ship the example secrets

    The Compose path will boot happily with the default database passwords — nothing stops you. So:

    • JWT signing keys are app-managed RSA — nothing to set. Rotate via POST /api/admin/jwt-keys/rotate when policy requires, and set ORBTRACE_SECRET_KEK so panel-stored AI keys are encrypted at rest.
    • Change PGPASSWORD and DORIS_PASSWORD.
    • Keep these out of source control. On Ansible the playbook refuses placeholder secrets — use Ansible Vault. On Kubernetes, prefer an external secret manager or sealed-secrets over plaintext in values.yaml. On Compose, your .env is plaintext on the host — protect it with file permissions and a host secret store.
  2. 2

    TLS everywhere

    • The UI / API: Orbtrace serves plain HTTP on 8080 by default. Put it behind TLS — the bundled Caddy edge profile (automatic certs), your own Nginx/Traefik, or the Helm Ingress tls. Never expose 8080 directly to an untrusted network.
    • Telemetry ingest: your Collector's OTLP ports (4317/4318) carry your spans and logs. Terminate TLS in front of the Collector (or configure its OTLP receiver with TLS) if apps reach it across untrusted links. This is Collector config, not Orbtrace.
    • Set ORBTRACE_FRONTEND_URL / ORBTRACE_BACKEND_URL to your https:// host so issued tokens and OIDC redirect URIs use the real, TLS-terminated address.
  3. 3

    Lock down the network surface

    On screen
    • Public (with TLS)Only the UI/API — port 8080 behind your proxy, or 443.
    • Loopback onlyDoris FE (8030/9030). The default compose binds it to 127.0.0.1 for a reason — it has minimal auth. Never put it on a LAN; use an SSH tunnel for DBA access.
    • Internal onlyPostgreSQL and Valkey are not published at all. Keep them that way.
    • Dev profiles — never in productionThe observability (Grafana admin/admin), oidc (Keycloak admin/admin) Compose profiles ship dev-grade default credentials. They're for local development only — don't enable them on an exposed host.

    On Kubernetes, enable the chart's NetworkPolicy (networkPolicy.enabled: true) — it's off by default and, once on, applies a default-deny baseline plus per-tier allow rules.

  4. 4

    Authentication posture

    • Use SSO in production. Wire at least one OIDC provider so your IdP's MFA, conditional access, and offboarding apply to every sign-in (see Authentication). Orbtrace inherits whatever policy your IdP enforces.
    • Leave the local eval login off. ORBTRACE_BOOTSTRAP_ADMIN_PASSWORD enables a username/password form that has no MFA, no account lockout, and no rate limiting — it exists for demos. In production set only ORBTRACE_BOOTSTRAP_ADMIN_USERNAME (no password) to designate the admin, and sign in through SSO.
    • Least privilege. Orbtrace has two roles — USER (read + personal dashboards) and ADMIN (everything). Grant ADMIN sparingly; keep at least two admins so you can't lock yourself out.
    • Serve the SPA only over HTTPS so its session can't be observed in transit.
    • Refresh-token reuse-detection is on by default. Orbtrace rotates refresh tokens on every use and, if a rotated token is ever replayed (a theft signal), revokes the whole token family — the user re-authenticates and the stolen token is dead. It's the OAuth 2.1 complement to rotation; leave orbtrace.security.refresh-reuse.enabled on. (A small leeway tolerates a legitimate multi-tab refresh race without logging anyone out.)
  5. 5

    Trim the management surface

    The actuator endpoints are limited to health, info, metrics, and prometheus, and health detail is shown only to authorized callers. If you scrape /actuator/prometheus, restrict it at the proxy to your monitoring network — it's operational metadata, not secrets, but there's no reason to expose it publicly.

  6. 6

    Turn on the audit trail

    Sensitive actions (AI chat turns, config changes, dismissals) are written to an audit_events table. The retention sweeper is off by default (so rows aren't pruned below a compliance window). For SOC2-style requirements, keep audit retention long; if you want bounded growth, enable ORBTRACE_AUDIT_RETENTION_ENABLED with a max-age that meets your policy. PII redaction for the AI assistant is available and off by default — enable it (Admin → Astra PII) if prompts may contain regulated data.

  7. 7

    Keep the air-gap intact

    Orbtrace never phones home — licensing is verified offline. The only outbound traffic is the AI provider call if you enable RCA/Replay/Astra with a SaaS LLM. For a true air-gap, use the Ollama provider so no prompt ever leaves your network.

Quick checklist

  • Real DB passwords, kept in a secret manager
  • TLS on the UI; Doris/PG/Valkey not LAN-exposed
  • SSO configured; local eval password blank
  • Two admins; everyone else USER
  • NetworkPolicy on (Kubernetes)
  • Audit retention set to your policy; PII redaction on if needed
  • Air-gapped? Provider = Ollama

Next: Air-gapped operation.

PreviousUpgradesNextAir-gapped operation