Replace shared agent bearer token with per-device credentials #14

New Issue

2026-07-26T17:05:18+10:00

benvin commented

2026-07-26 17:05:18 +10:00

Problem. TOMSWALLAPI_AGENT_TOKEN is a single bearer token shared by
every agent, while DESIGN.md §14 specifies mTLS or Vault-issued per-device
tokens. With the shared token:

Any one compromised device can pull every device's rendered config — the
complete policy map of the estate, ideal reconnaissance for lateral movement.
Any device can report forged generation status for any other device,
corrupting the convergence view.
Revocation is fleet-wide: rotating out one lost device rotates everyone.

Proposal. Per-device identity, either:

mTLS with a per-device cert (Vault PKI issuance fits the house pattern), or
Vault-issued per-device tokens with the device ID as a claim.

The config endpoint must derive the device ID from the credential, never from
a client-supplied parameter. Status reports likewise. Keep the shared token
only as a bootstrap/enrollment path, if at all.

Acceptance. Device A's credential cannot fetch device B's config (404/403,
covered by a test), and cannot post status for B.

**Problem.** `TOMSWALLAPI_AGENT_TOKEN` is a single bearer token shared by every agent, while DESIGN.md §14 specifies mTLS or Vault-issued per-device tokens. With the shared token: - Any one compromised device can pull *every* device's rendered config — the complete policy map of the estate, ideal reconnaissance for lateral movement. - Any device can report forged generation status for any other device, corrupting the convergence view. - Revocation is fleet-wide: rotating out one lost device rotates everyone. **Proposal.** Per-device identity, either: - mTLS with a per-device cert (Vault PKI issuance fits the house pattern), or - Vault-issued per-device tokens with the device ID as a claim. The config endpoint must derive the device ID from the credential, never from a client-supplied parameter. Status reports likewise. Keep the shared token only as a bootstrap/enrollment path, if at all. **Acceptance.** Device A's credential cannot fetch device B's config (404/403, covered by a test), and cannot post status for B.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/tomswallapi#14