Email security@decdn.org. Please do not open a public issue for security reports. That includes a secret or real host address you find committed here.

This repo holds the deployment tooling for a deCDN node: the Ansible roles, the decdn.node Galaxy collection, the cloud-init user-data, the Docker Compose file, and the Helm chart. Reports about the node daemon or protocol belong to decdn/decdn, but the same address reaches both.

The security model these tools follow is described in README.md § Security model: nothing secret committed, loopback-only backends, default-deny inbound, DevSec host hardening.

In release install mode, and while decdn_verify_release_signature keeps its default of true, the decdn_node role checks every downloaded tarball against the release's GPG-signed SHA256SUMS, using the maintainer key vendored at ansible/roles/decdn_node/files/decdn-release-KEYS.asc. That key is a copy of upstream's KEYS:

Ant Somers <ant@decdn.org>
Fingerprint: DA75 1570 6F18 73D2 74D8  A369 9E11 A9FF D62D AADB

The same fingerprint is published in decdn/decdn's SECURITY.md. Check a new copy of the vendored key against it before trusting that copy, with gpg --show-keys --with-fingerprint <file>.

Setting decdn_verify_release_signature: false (meant for an air-gapped mirror that strips signatures) drops that guarantee, and the role prints a warning when it's off. manual mode verifies nothing: it installs whatever binaries you point it at.

Published Helm charts (oci://ghcr.io/decdn/charts/decdn-node) are signed with a keyless cosign signature from this repo's release workflow; see RELEASING.md § Verifying a release.