CDNLite is suitable for local learning and controlled deployments. Production use requires deliberate authentication, secret management, TLS, and network controls.

1. Set CDNLITE_BOOTSTRAP_ADMIN_USER=0.
2. Set CDNLITE_BOOTSTRAP_EDGE_TOKEN=0.
3. Replace CDNLITE_SSL_SECRET_KEY, CDNLITE_ORIGIN_SHIELD_SECRET, EDGE_TOKEN, and all default passwords.
4. Set CDNLITE_API_TOKEN.
5. Serve core and dashboard only through HTTPS.
6. Restrict PostgreSQL, PowerDNS, and internal service ports to trusted networks.
7. Keep .env out of commits and backups that lack encryption.
8. Rotate edge tokens after operator turnover or suspected exposure.
9. Monitor security events and audit logs.

• Never expose EDGE_TOKEN, CDNLITE_API_TOKEN, PowerDNS keys, admin passwords, or SSL private keys in dashboard screenshots, logs, tickets, or public reports.
• VITE_* variables are compiled into browser assets; do not place production secrets there unless the whole dashboard is private and externally protected.
• Keep CDNLITE_SSL_SECRET_KEY stable across restarts. Losing it can make stored certificate material unusable.
• Use secret managers for production rather than plain .env files where possible.

Edge signed endpoints require:

• Authorization: Bearer <edge-token>
• X-CDNLITE-Edge-Id
• X-CDNLITE-Timestamp
• X-CDNLITE-Nonce
• X-CDNLITE-Signature

The signature is computed over method, path, timestamp, nonce, and SHA-256 of the raw body. Nonce and timestamp checks reduce replay risk.

The dashboard admin model is simple. It does not implement fine-grained RBAC, per-domain tenancy, SSO, or role-scoped permissions. Use external controls for production segmentation.

Open a private security report if the hosting platform supports it. Otherwise create a minimal issue without secrets or exploit details and ask maintainers for a private disclosure path.

Edge auth is implemented by EdgeAuthService. Each edge ID has one bcrypt token hash in edge_tokens. Operators provision or replace it with:

php core/artisan cdn:edge:register-token --edge_id=edge-local-1 --token=edge-dev-token
php core/artisan cdn:edge:rotate-token --edge_id=edge-local-1

The body hash is SHA-256 of the exact raw request body. For GET config, the body is empty. The canonical string is:

UPPERCASE_METHOD
PATH_WITHOUT_QUERY
UNIX_TIMESTAMP
NONCE
SHA256_RAW_BODY_HEX

The HMAC key is the SHA-256 hex string of the raw token. The signature is hash_hmac('sha256', canonical, hash('sha256', token)).

• POST /api/v1/edge/register
• POST /api/v1/edge/heartbeat
• GET /api/v1/edge/config
• POST /api/v1/collector/usage
• POST /api/v1/collector/security-events

For register and heartbeat, header edge ID must match body edge_id before signature validation succeeds.

Use a long random token for real edges, store it only in the agent environment or secret manager, rotate it with cdn:edge:rotate-token, and keep APP_DEBUG=0 outside development. Do not use edge-dev-token outside local Compose.

The Vue admin dashboard in dash/ is a client-only SPA served by Nginx. The old server-rendered backend dashboard routes are removed.

Local quickstart can bootstrap admin / admin from .env.example when CDNLITE_BOOTSTRAP_ADMIN_USER=1. Keep bootstrap disabled outside local development and create admin users with:

php core/artisan cdn:admin:create --username=admin --password='replace-with-a-long-password'

Core stores admin passwords with PHP password_hash. Login returns an opaque bearer session token whose SHA-256 hash is stored in admin_sessions; the dashboard keeps the raw session token in browser memory only. A browser refresh requires logging in again.

If VITE_CDNLITE_API_TOKEN is set, the built browser bundle can still send Authorization: Bearer <token> for control-plane API requests. Because Vite embeds VITE_* values into static assets, treat that option as suitable only for local or otherwise private deployments. Edge developer tool tokens are session-memory only and must not be stored in localStorage.

In production, put both the dashboard and the CDNLite API behind real authentication at the reverse proxy or platform layer. The dashboard admin model is not production RBAC.

The edge runtime bypasses cache storage and lookup when request risk is high:

• Non-GET/HEAD methods set cache bypass.
• Authorization header sets cache bypass.
• Cache-Control: no-cache or no-store sets cache bypass.

See Examples for copy-pasteable edge and API workflows.