Binions is built to keep a small attack surface and contain any failure to a single service. The whole platform runs on one Linux host, the daemons only talk to each other over the local machine, and a default-drop firewall means nothing is reachable from the outside unless you deliberately publish it. This page is the map of that model — what is exposed, where, and why — with links to the detailed pages for each topic.
Defence in depth. No single control is relied on. A network firewall, per-daemon operating-system sandboxes, file-based secrets, build-time dependency scanning, and a licence boot-check each cover a different layer.
Five ideas describe almost everything about how Binions is secured:
localhost through an internal event bus. There is no daemon-to-daemon traffic across your network to intercept.nftables firewall blocks everything by default. Only the handful of ports listed below are opened, and each is opened to the narrowest audience that needs it.Binions sorts every network surface into one of three tiers. The defaults are deliberately conservative: only the web edge is public, the operational tools stay on your own network, and the internal probes never leave the machine at all.
| Tier | What lives here | Who can reach it |
|---|---|---|
| Public | The Traefik HTTP/HTTPS edge — the front door for any web traffic you choose to publish | Anyone you expose it to (put it behind your own firewall) |
| LAN / cluster only | The MinIO S3 storage endpoint, the Jaeger tracing UI, the admin UIs (Traefik dashboard, MinIO console), and SSH | Your own network only |
| Loopback only | Every daemon’s /health and /metrics endpoints, the Traefik admin API, and the internal MinIO console | The host itself — never off-host |
Admin stays on your LAN by design. The dashboards, tracing UI, storage console, and health probes are not meant to face the internet. Keep them on your own network, and treat the public Traefik edge like any other public web service — behind your own firewall or reverse proxy, with TLS.
Each of the daemons runs under its own operating-system user — <name>svc — with no login shell and no privileges beyond what it needs. On top of that, every daemon is wrapped in a hardened systemd sandbox that strips away capabilities most services never use:
The practical effect is containment: a compromise or crash in one daemon is boxed in, and the other eleven keep running under their own separate identities.
Three further layers round out the model:
sudo systemctl restart binions-<name>apt upgrade is how you receive the fixes.Plan your perimeter. Licence enforcement is off by default, and the licence system is designed to deter casual abuse rather than act as DRM. Keep admin surfaces on your LAN, and front the public edge with controls you trust.