Security

Use it on a trusted local network

Power Manifold is designed for a local network where you trust the devices and the people on it, such as a home or office network.

• Do not make the controller reachable from the internet. Do not forward a router port to it or put it in a DMZ.
• For access from outside, use a VPN into your network, such as Tailscale or WireGuard. Add the name you use over the VPN to Host names.
• On a network shared with devices you do not control, such as a guest network, put the controller on its own network or VLAN.

What is encrypted

Connection	Encrypted	Notes
Web interface and HTTP API	Only with HTTPS	Plain HTTP unless you install a certificate and turn HTTPS on. On plain HTTP the API token is sent unencrypted with each change, and with each read while Require token for reading is on. See HTTPS.
MQTT	Only with TLS	Unencrypted unless your broker supports TLS and you turn it on. See MQTT security.
Wi-Fi setup	No	The Wi-Fi password is sent over a short-range wireless link. Run setup only when no untrusted person is near the chassis. See Wi-Fi setup.
Firmware updates	No	Each release is signed, and the controller installs only signed firmware. Encryption is not needed to keep an update from being altered. See Firmware updates.
Syslog	No	Messages go to your syslog server as plain UDP.

Anyone who can read traffic on your network can read the API token unless HTTPS is on, and the broker password with plain MQTT. This is why the controller belongs on a trusted network.

How the controller protects itself

• The API token. Every change over the network needs the API token: settings, port switching, updates, restarts and the web console. Reading the settings or the console log needs it too. Reading the status, the fault log, the certificate details and the Prometheus metrics does not by default; turn on Require token for reading in Settings (auth_read in the API) to require the token for those as well. With it on, the web page sends the token every second and a metrics scraper sends it with every scrape, so turn on HTTPS too. On plain HTTP the token crosses your network unencrypted each time.
• The token does not cover MQTT. The controller publishes its status to your MQTT broker and takes port, power, light and update commands from it, whatever the token settings are. Anyone your broker lets subscribe to the controller’s topics can read the status, and anyone it lets publish to them can make those changes. Limit both with your broker’s user accounts and access rules.
• No token, no changes. A controller with no API token refuses every change until first-time setup sets one. Setup is open, to anyone on your network, only for an hour after Wi-Fi setup or for the first hour after power-up over Ethernet.
• Other websites cannot reach it. A website you visit cannot use your browser to read from or change the controller. The controller answers only to its own IP address, its device name and the names in Host names, and during first-time setup it accepts only the requests its own page sends.
• Refused requests are logged. Each request refused for a missing or wrong token, an unknown name, or a setup rule is logged with the address it came from, on the console and to your syslog server. The Prometheus metric pwrman_http_refused_total counts them.
• Signed updates. The controller installs only firmware signed by this project and built for this hardware, and does not go back to an older version.
• Automatic updates. New releases, security fixes included, install by themselves at night, a few days after they come out. You can postpone them, skip a release, or turn them off.

Stored settings and passing a controller on

Settings are stored unencrypted on the controller, including the Wi-Fi password, the API token and the MQTT password. Someone with the controller in hand and the right tools can read them.

Before you give away, sell or return a controller, do a factory reset. It erases every stored copy of the settings, including the credentials, and the HTTPS certificate and its key.

A settings export made with passwords included holds them as plain text. Keep that file somewhere safe.

Reporting a security problem

Report security problems privately to security@powermanifold.io, or through Report a vulnerability on the project’s GitHub Security tab. Do not open a public issue. The security policy describes what happens next.

Security fixes come out as new controller firmware, which installs automatically unless you turn that off. See Automatic updates.

Note

Each firmware release lists the third-party software it contains in a software bill of materials, controller.cdx.json, attached to the release.