Security Architecture

How mikroHUB protects your network infrastructure

Document version: 2026-03-22 · Questions: [email protected]

Network Architecture

                              INTERNET
         ┌────────────────────┬──────────────────────┐
         │ HTTPS/443          │ WSS/443              │ WG/UDP 51820
         │ (TLS 1.2+)        │ (WebSocket)          │ (WireGuard)
         ▼                    ▼                      ▼
┌─────────────────────────────────────────────────────────────────┐
│  NGINX REVERSE PROXY  (mikrohub.io)                             │
│  ┌──────────────┐  ┌──────────────┐  ┌────────────────────────┐ │
│  │ Let's Encrypt │  │ HSTS Preload │  │ CSP + Security Headers │ │
│  │ ECDSA cert    │  │ max-age=2yr  │  │ X-Frame, X-Content     │ │
│  └──────────────┘  └──────────────┘  └────────────────────────┘ │
│  Ports open : 80 (→301), 443, 51820/UDP                         │
│  Ports BLOCKED: 3001 (API), 6379 (Redis)                         │
└──────────┬──────────────────────┬───────────────────┬───────────┘
           │ :3001               │ :3001/ws          │ :51820
           ▼                     ▼                    ▼
┌──────────────────┐  ┌──────────────┐  ┌──────────────────────────┐
│ EXPRESS API      │  │ WebSocket    │  │ WireGuard (wg0)          │
│ (Node.js)        │  │ Server       │  │ 10.99.0.1/16             │
│                  │  │ One-time     │  │ Per-device /32 peer      │
│ JWT validation   │  │ ticket auth  │  │ No split tunnel          │
│ 60s session cache│  │ (no JWT      │  │                          │
│ 1h max token age │  │  in URL)     │  │ Devices: 10.99.x.y      │
└────────┬─────────┘  └──────────────┘  └──────────────────────────┘
         │
   ┌─────┴──────┐
   ▼            ▼
┌────────┐  ┌────────┐
│Supabase│  │ Redis  │
│Postgres│  │ TLS    │
│(cloud) │  │(local) │
│RLS on  │  │ Auth   │
│all tbl │  │ reqd   │
└────────┘  └────────┘

All external traffic terminates at Nginx with TLS 1.2+. Internal services (API port 3001, Redis port 6379) are blocked at the firewall level and never exposed to the internet.

Authentication & Authorization

Layer	Mechanism
User AuthPKCE	Supabase Auth with PKCE flow (not implicit)
Token StorageCOOKIE	Secure + SameSite=Lax cookies (not localStorage)
Token LifetimeTTL	1 hour max, 60s cache, forced refresh
Session RevocationREVOKE	In-memory invalidation + token blacklist
WebSocket AuthTICKET	One-time ticket exchange (JWT never in URL)
API Key AuthSHA-256	SHA-256 hashed, scoped per-resource, expiry enforced
Device Agent AuthAGENT	SHA-256 hashed token, rate-limited (2 req/30s)
MFAMFA	TOTP (authenticator app) + WebAuthn/FIDO2 (passkeys, YubiKey)

Data Isolation (Multi-Tenant)

Org A — "ISP Gdansk"

devices (org_id=1)

metrics (org_id=1)

backups (org_id=1)

logs (org_id=1)

RLS BLOCKED

Org B — "Firma Warszawa"

devices (org_id=2)

metrics (org_id=2)

backups (org_id=2)

logs (org_id=2)

Row-Level Security (RLS) on ALL data tables
Enforced at PostgreSQL level — even SQL injection cannot cross tenant boundaries
API middleware double-checks org membership on every request
WebSocket subscriptions validated against org_members

Device Credentials

Encrypt

AES-256-GCM with random IV per entry, auth tag validated

Store

Stored as iv:tag:ciphertext in Supabase (never plaintext)

Decrypt at Poll

Decrypted only at poll time, in-memory, never logged

Connect

RouterOS API-SSL with TLS encrypted connection

Master encryption key in environment variable (not in code, not in DB)
Credentials decrypted only when needed for device connection
Error messages redact IPs and credentials via regex
Credential never appears in logs, responses, or audit trail

Connection Modes

API Management

Direct TLS connection via API-SSL (port 8729). Full management access.

TLS encrypted
IP-restricted to mikroHUB
Port 8729 only

WireGuard

Encrypted tunnel — zero open ports required on the router.

No public ports needed
Per-device /32 peer
No split tunnel
Single copy-paste setup

API Monitoring

Read-only direct TLS connection. No write access to router.

Read-only access
TLS encrypted
IP-restricted

Agent

Device pushes data outbound via HTTPS. Nothing inbound.

Outbound only (HTTPS)
No open ports needed
Push-only model
Rate-limited (2 req/30s)

Infrastructure Security

Component	Protection
✓TLS	TLSv1.2 + TLSv1.3, ECDHE ciphers, HSTS preload
✓Firewall (UFW)	Only 80, 443, 51820/UDP exposed. API (3001) and Redis (6379) DENY
✓Redis	TLS enabled, password required, localhost-only binding
✓Nginx Headers	HSTS, X-Frame-Options, X-Content-Type-Options, CSP, Permissions-Policy
✓Rate Limiting	Global 300/15min, Auth 5/min, Admin 30/15min, Agent 2/30s
✓DH Parameters	2048-bit dhparam for forward secrecy

What We DON'T Do

❌ We don't store passwords in plaintext — ever
❌ We don't use localStorage for tokens
❌ We don't expose internal services to the internet
❌ We don't allow cross-tenant data access
❌ We don't log credentials or sensitive data
❌ We don't require open ports on your router (WireGuard mode)
❌ We don't send plaintext API connections (SSL required for direct mode)

Compliance

Standard	Status
HTTPS everywhere	✅Enforced
Encryption at rest	✅AES-256-GCM for credentials
Encryption in transit	✅TLS + WireGuard
Authentication	✅JWT + MFA + PKCE
Authorization	✅RBAC + RLS
Audit trail	✅Full audit log with IP tracking
Data deletion (GDPR)	✅Account erasure endpoint
Session management	✅Token blacklist + forced refresh

Questions about security?

We are happy to answer any questions from prospective customers and auditors.

[email protected]