Security and public access

Public deployments combine browser verification, durable admission controls, trusted ingress administration, and private artifact delivery. Enabling Turnstile alone does not establish the deployment boundary.

Verification and ownership

Anonymous submission and download requests require a browser/IP-bound human session. Turnstile exchange happens server-side and requires the configured Origin. The human session lasts 15 minutes without sliding extension; a separate 30-day browser cookie identifies ownership. Both use Secure, HttpOnly cookies.

An accepted build continues after verification expires. A new download or resumed request requires valid verification again. Existing gateway transfers can continue past verification expiry, but remain subject to lease renewal and ban checks. Cancellation uses browser ownership or administrator authority rather than human verification alone.

Shared admission and abuse controls

Anonymous admission allows three accepted submissions per rolling 24 hours and one outstanding build per canonical IP, with a waiting limit of twenty. Failed and canceled builds count. Idempotent retries recover the original submission rather than consuming another slot.

Redis request limits are shared across replicas. IPv6 traffic also uses a /64 request bucket. Downloads have a request allowance and a two-per-IP transfer lease limit. Quota exhaustion and dependency outages do not themselves count as abuse strikes.

Repeated request-rate rejections or invalid verification can produce durable escalating bans. The shared Redis ban snapshot is reconstructed from PostgreSQL when necessary; missing enforcement state fails closed. Administrative unblocking does not reset quotas or restore revoked sessions.

See abuse enforcement for exact windows, thresholds, retention, and administrative endpoints.

Trust boundaries

Ingress must strip caller-supplied administrative identity headers before attaching authenticated Authelia values. The API accepts identity only from configured immediate proxy CIDRs and requires the exact administrative group. Restrict direct backend access so clients cannot bypass that ingress boundary.

Canonical client IP handling depends on ingress overwriting X-Real-IP using its trusted upstream chain. Do not trust arbitrary forwarding headers or CIDRs containing public clients. Public API and gateway replicas must share compatible proxy and enforcement settings.

The compiler must not receive repository credentials. Module preparation uses its own SSH identity and known-host verification. Private gateway storage credentials must not grant publication or deletion. Published objects must not be overwritten.

Public information and logs

Public build responses use an explicit field allowlist. Raw compiler errors, repository details, private identities, and storage locations stay out of public DTOs. Public SSE reports fixed progress categories; it is not a transcript with a few strings removed. Raw diagnostics remain administrative data.

Artifacts remain private. The gateway checks successful publication and recorded size/checksum, then streams bytes without exposing an object-store URL. It disables shared caching and interrupts transfers when enforcement renewal fails.

Configuration details: Authelia, verification, public logs, and gateway. Earlier “remaining work” sections in historical documents may be superseded by their later implementation notes.