Security & Maintenance

How ImpulseSecrets encrypts and isolates data, manages every box through a scoped Admin Proxy, tracks CVEs against the running engines, and upgrades in place — plus the crons that keep it all running.

1. Encryption & isolation

Shared and Dedicated tiers encrypt data at rest with AES-256-GCM, per-organization and per-project isolation, and audit logging, under operator-managed keys. BYOK adds a customer-managed external KMS — sealing the server on OpenBao, backing project encryption on Infisical (see Customer-managed keys).

• Shared — a multi-tenant instance per region; each customer gets an isolated organization/namespace.
• Dedicated — a single-tenant VPS per customer; no neighbors.
• BYOK — a dedicated box bound to the customer’s KMS, failing closed if they revoke access.

No unsupported claims

The module never claims zero-knowledge, end-to-end, or customer-held-root-key encryption for any tier — that copy is blocked in code. Only the documented AES-256-GCM and customer-managed-KMS claims are permitted in customer-facing surfaces.

2. The Admin Proxy management plane

Scoped Admin Proxy is the default and only normal management plane for every provisioned box. Each Secrets box runs a typed, scoped admin proxy (registered in the module’s server registry, health path /admin/v1/health). The module authenticates with a per-server encrypted Bearer secret and strict X-Impulse-* scope headers, and the box’s firewall admits the proxy only from the WHMCS server IPs set under Settings → General & Access. A box without a publicly trusted certificate is reached with TOFU SPKI pinning: WHMCS pins its self-signed certificate on first contact.

Typed verbs only

The proxy exposes typed, scoped, audited operations (health, bootstrap re-apply, backup and restore, TLS reissue, security updates) — never a free-form shell. Normal config changes and reapplies go through the proxy’s apply endpoints, never an SSH rebuild. Break-glass SSH is HIGH RISK, off by default, and gated behind an explicit operator toggle; when off, no provider SSH keys are injected and no SSH console/rebuild actions are exposed.

The proxy source is embedded verbatim in each engine’s cloud-init bootstrap and hashed for drift detection against running boxes, so a config-apply always ships the exact app the box booted with.

3. Secrets handling & audit

• Encrypted at rest in WHMCS. Admin tokens, proxy secrets, S3 access/secret keys, and KMS credential payloads are stored encrypted; the env contributor masks sensitive values with ***.
• Audit through Core. Every customer-visible state change is written to ImpulseCore’s audit log. Diagnostics → Activity surfaces it.
• No admin tokens in the client area. Customers authenticate with their own machine identities and tokens; the client area never displays a server admin token.

4. CVE posture & in-place upgrades

The module tracks the running engine builds against known CVEs and coordinates upgrades without mutating a live binary.

• CVE tracking — the manifest declares CVE products for both engines; a security collector reports the running engine version from each box’s snapshot, and an actuator coordinates remediation.
• Version pinning — engine versions are pinned under Settings → General & Access (Default OpenBao version, Default Infisical version). A dedicated or BYOK box running another version offers Request upgrade on the Infrastructure tab; you approve it, and it runs inside the maintenance window — or use Execute now. A pre-upgrade backup is taken automatically.
• Redeploy, not mutate — the upstream_upgrade cron (every 5 minutes) applies scheduled in-place engine upgrades using the redeploy upgrade class: deliver-then-apply rather than patching a running process.

Operations → Security and the Overview security panel surface pending updates and posture. The addon’s own update check never blocks the admin: when the release server can’t be reached, it shows “up to date” instead of an error.

5. Health, TLS coverage & the cron schedule

Health, usage, and TLS are continuously collected and surfaced under Diagnostics → Health Checks: a cron panel, a diagnostics matrix, per-server health, a live TLS-certificate panel, and a diagnostic export. All of it runs through ImpulseCore’s cron runner — the module registers eleven tasks and adds no crontab line of its own.

Cron	Cadence	Role
provision	2 min	Advance queued dedicated/BYOK provisioning
health_check	5 min	Probe shared servers and services
domain_polling	5 min	Poll Cloudflare custom-domain DNS/SSL status
usage_metering	15 min	Snapshot per-service usage into history
migration	5 min	Advance in-flight migrations
backup_sweep	Hourly	Run due scheduled backups across services
backup_purge	Daily	Expire and delete backups past retention
reseal	Weekly	BYOK re-validation, rebind / reseal
free_tier_inactivity	Daily	Log free-plan services with no recent usage (takes no action)
alert_detection	Hourly	Raise alerts from collected signals
upstream_upgrade	5 min	Apply scheduled in-place engine upgrades

Verify TLS against live SANs

A wildcard on the apex does not cover a deeper per-server hostname. The TLS certificates panel handshakes with each server and lists the SANs of the certificate it presents right now — check them against the server’s hostname rather than trusting the configuration, and reissue when they don’t match.

Empty is correct

Empty observability tables before any activity are the right state, not a fault. Usage populates within about 15 minutes of provisioning.

6. Backups & maintenance windows

Backups are a premium feature for Dedicated and BYOK services whose plan has Automated backups on. Set the storage driver under Settings → General & Access: Disabled, Local WHMCS filesystem, or the S3-compatible option (off-box S3-compatible storage is the production choice; Test Backup Storage writes and deletes a test object). Each backup is an AES-256-GCM envelope-encrypted node/database dump; the manifest is recorded with type, size, checksum, and expiry, and backups are kept for 7 days by default. Types include daily, weekly, monthly, manual, pre-migration, pre-terminate, and pre-upgrade. Customers on those plans can run Backup now themselves; restores are admin-only.

Operations → Maintenance manages maintenance windows and customer-facing banners. To upgrade, update ImpulseCore first, then upload the new module release — always test on a dev WHMCS before production, because every dependent surface trusts Core.