Security and TLS

Authentication

Password

The board uses a single shared password for dashboard and API access. The default password is password, and the dashboard makes you change it at first login. Until it is changed, the board refuses every change and every export (from the dashboard, the API, fleet peers and Home Assistant); viewing status still works. The HDMI kiosk screen asks for the same password and never signs in by itself.

Password requirements:

• Minimum 8 characters
• Changing the password invalidates all active sessions (all users must log in again)

Sessions

• Login returns a Bearer token valid for 24 hours
• Tokens are invalidated on password change or logout
• Login is rate-limited to 120 attempts per minute per IP address

Changing Your Password

1. Click Settings or the gear icon in the dashboard
2. Enter your current password
3. Enter and confirm your new password
4. Click Change Password

All existing sessions are invalidated. You will be redirected to the login page.

TLS Certificates

The dashboard is served over HTTPS. Three certificate modes are available:

Self-Signed (Default)

A self-signed certificate is generated automatically on first boot. The dashboard works immediately. Browsers will show a certificate warning, which is expected and can be safely accepted for local network use.

Custom Certificate Upload

Upload your own certificate for trusted HTTPS without browser warnings:

1. Obtain a certificate from your Certificate Authority (or internal CA)
2. Go to the TLS settings in the dashboard
3. Upload the certificate file (.crt or .pem) and private key file (.key)
4. The certificate is applied immediately with no service restart

The hot-swap is atomic. Active connections continue on the old certificate; new connections use the new one.

ACME (Let’s Encrypt) - HTTP-01

For boards with a public DNS name and inbound internet access:

1. Assign a DNS name to the board’s IP address
2. Go to the TLS settings and select ACME mode, then enter the DNS name, the optional contact email, and the ACME directory URL (for Let’s Encrypt: https://acme-v02.api.letsencrypt.org/directory)
3. Restart the management service. Switching into ACME mode takes effect after the restart
4. The platform requests the certificate from the directory you entered
5. Certificates auto-renew before expiry

Requirements:

• The board must have a public DNS name
• Port 80 must be accessible from the internet (HTTP-01 challenge)

Private Networks and Air-Gapped Boards

The built-in ACME client uses the HTTP-01 challenge only. A DNS-01 challenge is not built in.

For a board that cannot be reached from the internet, get the certificate on another machine with your own ACME tool (for example certbot with the DNS challenge), then upload it to the board:

curl -k -X POST -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{\"cert\": \"$(base64 < fullchain.pem | tr -d '\n')\", \"key\": \"$(base64 < privkey.pem | tr -d '\n')\"}" \
  https://<board-ip>/api/v1/system/tls/cert

The certificate is hot-swapped atomically. No service restart required. Certificate renewal on this path is yours to run: repeat the upload each time the certificate is renewed.

Viewing Certificate Info

The dashboard shows the current certificate details including:

• Subject (CN and SANs)
• Issuer
• Expiry date
• Current mode (self-signed, upload, or ACME)

Audit Logging

Every action that changes board state is recorded in the audit log:

Viewing the Audit Log

The most recent entries appear in the Recent Activity section at the bottom of the dashboard. Click to expand and see more entries.

The full audit log is available via the API with pagination:

curl -k -H "Authorization: Bearer <token>" \
  "https://<board-ip>/api/v1/system/audit?limit=50&offset=0"

Log Retention

Audit logs are stored in the board’s SQLite database and included in backup exports. Logs persist across reboots and service restarts.

Network Security

Local-Only by Default

The management platform listens on the board’s network interfaces. It is accessible to any device on the same network. There is no cloud component, no external account, and no outbound data transmission (except ACME certificate requests if enabled).

HSTS

HTTP Strict Transport Security headers are enabled by default with a 1-year max-age. This tells browsers to always use HTTPS when connecting to the board.

No External Dependencies

The platform requires no internet connectivity for normal operation. All features work on air-gapped networks. The only feature that requires internet access is ACME (Let’s Encrypt) certificate provisioning.

Fleet Security

Fleet communication between paired boards uses Ed25519 digital signatures. Each request includes a signed timestamp with a 5-minute replay window. Board identity is verified against stored public keys from the pairing process.

Last modified October 18, 2026