Deployment
Network and security deployment
The trust boundary for Portivo v2.0.0.
Default listener
The default application bind is 0.0.0.0:8766 and the default public URL scheme is HTTP.
Do not expose Portivo directly to the public Internet. Portivo handles privileged network operations and personal SSH credentials. Use a dedicated management network, firewall restrictions and HTTPS for browser access where possible.
HTTP on a trusted management LAN
With PUBLIC_URL_SCHEME=http, session cookies remain HttpOnly and SameSite=Strict, but browsers cannot mark them Secure over plain HTTP. This mode should remain inside a trusted management network.
Recommended controls
- Restrict TCP 8766 at the host firewall and upstream firewall.
- Allow only required administrative subnets.
- Do not NAT/publish Portivo to the Internet.
- Use a trusted TLS reverse proxy for browser access across shared or less-trusted paths.
- Protect the host, database,
.env, backup directory and application secret.
Current security boundary
2.0.0 adds same-origin checks for terminal WebSockets, blocks webhook redirects, bounds CSV/XLSX imports, expands CSP coverage, disables public API docs and minimizes public health metadata. It intentionally leaves existing LAN exposure, SSH trust behavior and service-account behavior unchanged for follow-up work.