Security Recommendations

The default configuration supports local demonstrations and development on a trusted intranet. If other hosts can reach the deployment, examine the credentials, network access, and sensitive files.

For production, also review the Security Model, Compliance, and Security Considerations.

Passwords

Pigsty publishes its default credentials in the source code and documentation. Do not use these credentials in production.

Run the configuration wizard with -g to generate random passwords:

./configure -g

The wizard replaces the built-in parameters and example credentials that it recognizes. It does not replace these credentials:

• The pgBackRest cipher_pass.
• Silo user passwords and selected example passwords in ha/safe.
• Database, object-storage, or application credentials that you added yourself.

After generation, examine pigsty.yml. Replace every credential that the wizard did not change.

The wizard prints generated passwords to the terminal. Protect terminal records and automation logs that contain these passwords. See the Default Credentials Checklist for the complete scope.

Firewall

The default value of node_firewall_mode is zone. This mode trusts the intranet defined by node_firewall_intranet. It restricts access to ports from public networks.

For production, normally remove port 5432 from the demonstration configuration. If applications require direct database access, permit only their source addresses. Apply these restrictions in the cloud security group, host firewall, and PostgreSQL HBA rules.

Make sure that the intranet definition matches your trusted network. The default RFC 1918 address ranges can include networks that you do not trust. Do not automatically trust office networks, container networks, or other tenant networks.

Files

These files and directories contain sensitive information:

Restrict access to the administration node and configuration repository. Do not commit complete inventories or private keys to public repositories. Keep controlled backups of the CA private key and required configuration.

Related Documentation

• Security and Compliance introduces the security model.
• Authentication explains HBA rules, passwords, and client certificates.
• Encrypted Communication explains the CA, TLS, and server verification.
• Production Security Considerations supplies the complete deployment checklist.