Tunnels and security

Chalupa reduces the public attack surface in two ways: it rewrites Compose ports to listen on loopback, and it uses an outbound telemetry flow. Only SSH needs to accept inbound traffic.

How ports are rewritten

This Compose mapping:

services:
  api:
    ports:
      - "8080:8080"

becomes this mapping on the droplet:

services:
  api:
    ports:
      - "127.0.0.1:8080:8080"

The process does not invent a second port list. task tunnel consumes outputs derived from the same Compose file.

Open the tunnel

Keep the absolute config path:

export DEMO_CONFIG="/path/to/project/chalupa.yml"

task tunnel CONFIG="$DEMO_CONFIG"

Conceptually, SSH creates one rule per port:

ssh -N -L 8080:localhost:8080 root@192.0.2.44

192.0.2.44 belongs to an RFC 5737 documentation range. The task reads the real address from Pulumi output; do not copy it into public documentation.

While SSH remains active:

• http://localhost:8080 reaches the remote API;
• a local client can use localhost for the database;
• suites do not need to know the droplet IP.

What is exposed

The expected result is:

Review the preview to verify every bind. A provider firewall adds another layer of defense; it does not replace this review.

SSH keys

Use managed keys and limit who can start tunnels. Do not permanently disable host verification. The first connection can explicitly accept a new key; investigate any later change.

The remote account and keys are outside the Chalupa console's scope. The console shows commands, but it does not store private keys.

Secrets

Treat these values as secrets:

• provider API token;
• ingest HMAC key;
• Chalupa administrator token;
• service-specific secrets.

They must not appear in:

• chalupa.yml;
• URLs or query parameters;
• suite-run payloads;
• logs or screenshots;
• public metadata;
• commits.

The agent receives only the credential it needs to sign ingest requests. The control plane uses a separate read-only credential for cost estimates. The current version does not give the droplet a deletion credential.

Signed signals

The agent signs the exact body before sending it. The control plane verifies the signature and time window before it persists the observation.

HTTPS protects the transport; HMAC authenticates the sender and detects changes. Rotate the key like any other fleet secret. The read API never returns it.

The console is not an execution panel

The first version is read-only. It does not include buttons to launch or sink resources because those controls require stronger credentials, real identity, and a trusted worker. Operations remain in task, where you can see the context and confirm your intent.