Keys are shown once
Only a hash of each key is stored. A lost key is revoked and replaced, never shown again.
DokkitSecurity
Security
What the program can and cannot do on your machines, what your server keeps, and how to check a release yourself before you trust it.
On each machine
The dokkit program opens no port. It makes one connection out to your server and keeps it open. Nothing can connect in to it.
What it does
- Sends a beat with the machine's readings every minute, and each check's result on the schedule its file sets (every 30 seconds unless it says otherwise).
- Reads the log files you point it at, and the
dokkit.tomlfiles in folders you added. - Once a day, looks the machine over and proposes what to watch. Nothing it finds is watched until you accept it.
- Restarts a service only when you have allowed restarts for that service.
- Installs an update only when you approve it, and only if its signature checks out.
What it never does
- Listen on a port.
- Run a command your server sends it. There is no remote shell.
- Send anything to dokkit.dev. The program talks to your server, and your server to nobody you did not set up.
- Ask you to turn off antivirus.
On your server
Everything stays on your own hardware, in your own Postgres. Logs are kept a year, then archived to a folder you name.
Four kinds of key
One to enrol a machine, one per machine, one per app, and tokens for people and their agents. Each can do only its own job.
Full control asks twice
A token that can do everything is made only after you type the server's own address. Every other token is limited to what you switch on.
Error messages are dropped
Errors keep their type and their stack. The message, where personal data ends up, is kept only for a service you set to keep it.
The first visit is yours
The owner account needs the setup code the server printed when it started, so nobody else on the network can claim it first.
Two-step sign-in
Each person can add an authenticator app, with recovery codes for the day the phone is lost.
Releases
Every release carries a list of its files' SHA-256 sums, signed with the release key. The installers and the updater refuse anything whose signature does not check.
The release key, as Ed25519:
xX87EOVIFN9AkYL7vMj40ivpQ36bRyvJGLOMIbgAmRk=Check a release yourself 3 commands, with openssl
Download SHA256SUMS, SHA256SUMS.sig and the files you want from the release, into one folder.
- Save the key as a file:
-----BEGIN PUBLIC KEY----- MCowBQYDK2VwAyEAxX87EOVIFN9AkYL7vMj40ivpQ36bRyvJGLOMIbgAmRk= -----END PUBLIC KEY-----
as
release-key.pem. - Check the signature on the list:
base64 -d SHA256SUMS.sig > sig.bin && openssl pkeyutl -verify -pubin -inkey release-key.pem -rawin -in SHA256SUMS -sigfile sig.binIt prints
Signature Verified Successfully. - Check the files against the list:
sha256sum -c SHA256SUMS --ignore-missing
The project hands out no builds signed with anyone's code-signing certificate. Whoever builds signs their own.
The phone
The phone apps are read-only. Your server seals a snapshot each minute and leaves it at a relay; the phone fetches it and opens it. The relay cannot read it, and nothing comes back in.
- The server never opens a port to reach the phone. It only dials out to the relay.
- A phone is paired by scanning a code Dokkit shows once, for two minutes. Removing the server in the app deletes its key from the phone.