Security
Your servers, your rules, written down.
Coswarm runs with root on your servers, so it is built to be careful with it: permissions per area, a second pair of eyes where you want one, secrets that stay secret, and a record of everything.
Who can do what
- Roles you define, with create, read, update and delete set separately on each of 24 areas: apps, domains, secrets, the console, Cosmo and the rest.
- Four-eyes approval for roles, users, apps, domains, secrets or settings: a change there waits for someone else, with a field-by-field diff, and nobody approves their own.
- An area can only be held once another user is able to approve, so nobody locks themselves out.
Signing in
- Two-factor sign-in with TOTP. Wrong codes are capped per account, and a used code cannot be played again.
- Sign-in attempts are rate limited per address, and a sign-in alert can be emailed.
- The session lives in an HttpOnly cookie. Changing a password ends the sessions already open.
- Each installation signs its sessions with a key of its own.
Secrets
- Swarm secrets, mounted into apps as files. A value goes in once and is never shown again.
- Generated passwords and model provider keys are encrypted with AES-GCM and never sent back to the browser.
- Secret values are hidden in the approval diffs and masked before anything reaches Cosmo’s model.
The network and the edge
- Your services talk over a Swarm overlay network created with encryption on.
- HTTPS on every domain, with Let’s Encrypt or your own certificate.
- A WAF per domain, Coraza with the OWASP Core Rule Set, IP allowlists that drop everyone else, and basic auth.
A record
- The activity log: who did what, when and from which address, filterable and grouped by day.
- Opening a console session on the host is logged too.
- Cosmo keeps its own record of every change it ran, and who approved it.
Cosmo
- It can do only what the user’s role allows, checked when a change is planned and again when it runs.
- Every change waits for an approval of that exact plan; it has no shell, no SQL and no access to users or roles.
- In areas held for four eyes it does not act at all.
Worth knowing
Powerful on purpose.
The panel’s console and file manager reach the host as root, because running servers sometimes needs that. Give those areas only to the roles that should have them, and consider holding settings and roles for four eyes.
After installing, sign in and change the first administrator’s password before anything else, and turn on two-factor sign-in.
Found a security issue?
Please tell us privately before telling anyone else. We read every report and reply with what we will do and when.
contact@coswarm.devYour servers are waiting.
One command, a minute or so, and the panel is on your domain. Free, and yours to keep.
curl -fsSL https://coswarm.dev/install.sh | bash