Tokens and roles
| Token | Variable | Can |
|---|---|---|
| Administrator | GENESISDB_AUTH_TOKEN | everything, including backup, restore, audit, erase, schema registration and index rebuild |
| Writer | GENESISDB_WRITE_TOKEN | read and commit |
| Reader | GENESISDB_READ_TOKEN | read |
Generate each token with openssl rand -hex 32, at least 32 bytes are required. Tokens are store-wide, there are no per-subject permissions. Restart the server to rotate them. Legacy route aliases enforce the same roles.
Network
- The server binds to
127.0.0.1by default. Keep it on loopback or a private network. - Use TLS before sending bearer tokens over a network: set
GENESISDB_TLS_CERT_FILEandGENESISDB_TLS_KEY_FILE, or put a TLS reverse proxy in front. TLS 1.2 is the minimum. /pingand the Prometheus metrics are unauthenticated. Keep the metrics listener on a trusted network.- The API allows cross-origin requests without cookies. Never put an administrator token into an untrusted web page.
Files
New files and directories are created owner-only (0600 and 0700). Run GenesisDB under an unprivileged account and one process per data directory. Data is not encrypted at rest.
Limits
Nothing is capped by default. For shared or exposed deployments set the optional caps for request size, read size, concurrency and request duration, see Configuration, and add operating system or container quotas for memory, CPU and disk.
Reporting a vulnerability
Report suspected vulnerabilities privately to mail@genesisdb.io. Only the latest release receives fixes.