Security

Nolay works on your server, so the main question is what it can do there. The answer can be checked on the server itself with the commands below.

The agent

• Runs as the nolay system user in the docker group, not as root. The systemd service runs with restrictions: NoNewPrivileges, ProtectSystem=strict.
• Listens on no inbound ports: one outgoing WSS connection to the hub on 443, and a second one to the relay only when the tunnel is on.
• Runs only a closed list of operations: deploy, rollback, stop, logs, secrets, backups, domains. An arbitrary command cannot be run on the server through Nolay.
• The binary is downloaded from get.nolay.ru and verified by checksum before install.

Project containers

Containers start without extra Linux capabilities (cap_drop: ALL and a short list of needed ones) and in their own Docker network. Extra capabilities are granted only explicitly with run.privileged_caps, and each one is written to the agent log.

Tokens and secrets

• The agent token is shown in the panel once and is not stored in the panel. On the server it lives in /etc/nolay/agent.token with mode 0600.
• Secret values are stored only on the server, encrypted. See Secrets and What is stored where.

Panel sign-in

Two-factor authentication with a code from an app is turned on in the profile. An organization has roles: owner, admin, member and viewer. Tunnels, archive uploads and service passwords are changed only by owners and admins.

Check it yourself

ss -tulpn
ps -o user,pid,cmd -C nolay-agent
systemctl show nolay-agent -p User -p NoNewPrivileges -p ProtectSystem