Security Hardening

The platform's attack surface is deliberately small: one external endpoint (/graphql), internal services on a private Docker network, and cameras on their own segment. Hardening is mostly about preserving that shape in production — do not expose VPP, the message broker, or PostgreSQL beyond the node host, and put TLS and authentication in front of the single endpoint that is exposed.

Network and access

Terminate TLS at a reverse proxy in front of the Hub's /graphql endpoint and restrict reachability to the operational network where officers, displays, and integrator systems live. Keep cameras on a dedicated VLAN with no route to anything but the node; camera credentials and RTSP URLs are configuration secrets. In multi-node deployments, treat the follower-to-master VPP link as trusted infrastructure traffic — private link or VPN, never the public internet.

Secrets and supply chain

Registry credentials are per-client robot accounts scoped to your entitled products — store them in your secret management, not in shell history or committed .env files. The same applies to the license file and any watchlist provisioning credentials. Pull images only from the official Innovatrics and GitLab registries (see First Deployment) and pin versions rather than tracking latest in production.

Data protection

The strongest control is not storing data at all: with STORAGE_ENABLED=false, the node persists no event data at rest — the recommended mode for GDPR-sensitive deployments. Where storage is on, retention TTLs for events and images are enforced by a scheduled job and should be set to the minimum your operation needs; face crops and frames are personal data and belong in your records-of-processing documentation. Details in Event Storage & Retention.