> ## Documentation Index
> Fetch the complete documentation index at: https://freelance-4888ed08.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Authentication and Authorization models

EngineeringOperations

> [!NOTE]
>
> **What this does:** Secures the platform with role-based access control, API key authentication (Argon2id), and network isolation — ensuring only authorized users can access predictions and admin tools.

The system enables secure access through Airflow's native Role-Based Access Control (RBAC) and network isolation strategies.

## Authentication Model

The platform uses **Basic Authentication** backed by Airflow's session management.

```yaml docker-compose.yaml theme={null}
AIRFLOW__API__AUTH_BACKENDS: "airflow.api.auth.backend.basic_auth,airflow.api.auth.backend.session"
```

### User Provisioning

Initial admin users are provisioned during container startup via the `airflow-init` service.

| User | Role | Access Level |
| :- | :- | :- |
| `Cole` | `Admin` | Full System Access |

## Role-Based Access Control (RBAC)

We utilize the standard Airflow security model to segregate duties.

```mermaid theme={null}
graph TD
    %% Styling
    classDef admin fill:#4F46E5,stroke:#fff,color:#fff,stroke-width:2px;
    classDef ops fill:#FEF3C7,stroke:#B45309,color:#78350F,stroke-width:2px;
    classDef user fill:#DCFCE7,stroke:#15803D,color:#14532D,stroke-width:2px;
    classDef viewer fill:#F3F4F6,stroke:#6B7280,color:#1F2937,stroke-width:2px;

    %% Nodes with HTML labels for Permission Details
    Admin["<b>Admin</b><br/>+Create Users<br/>+Manage Connections<br/>+Edit DAGs"]:::admin
    Op["<b>Op</b><br/>+Trigger DAGs<br/>+View Logs<br/>+Manage Variables"]:::ops
    User["<b>User</b><br/>+View DAGs<br/>+View Logs"]:::user
    Viewer["<b>Viewer</b><br/>+View DAGs"]:::viewer

    %% Hierarchy (Admin has most power, Viewer least)
    Admin --> Op
    Op --> User
    User --> Viewer

    %% Link Styling
    linkStyle default stroke:#6366f1,stroke-width:2px;
```

## Network Security

> [!WARNING]
>
> **Production Note**: In the current Docker Compose setup, internal services like **PostgreSQL** and **Redis** are NOT exposed to the host machine, ensuring database isolation.

* **Publicly Exposed**:
  * Airflow Webserver (`8080`)
  * MinIO Console (`9001`)
* **Internal Only**:
  * PostgreSQL (`5432`)
  * Redis (`6379`)
  * Airflow Worker / Scheduler / Triggerer

## Key Rotation & Generation

To simplify security management, we provide a utility script for generating cryptographically secure keys.

### Usage

```bash theme={null}
python scripts/generate_security_config.py
```

**Output**:

```text theme={null}
1. Airflow Fernet Key: "..."
2. Airflow Webserver Secret Key: "..."
3. MinIO Credentials: ...
```

This ensures that `AIRFLOW__CORE__FERNET_KEY` and other secrets are rotated safely before deployment.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.