Data is categorized into 5 broad storage classes, ordered from most to least sensitive.
* personal (default):
stored on an encrypted disk secured with a tpm or passkey. access to the device is restricted to trusted beings.
this includes secret values like encryption keys and any other local data that isn't meant to be transmitted.
* private:
transmitted over an e2ee channel with a trusted peer.
* ephemeral:
session keys, edge router keys, &c.
* public:
transmitted to a group, not really sensitive.
* broadcast:
meant for anyone and everyone's ears. should not be sensitive at all.
Device types are assigned a storage class based on how easily they can be secured against unauthorized access. Ops will need to carefully asses their situation to make the right call on how to classify their devices. These tags are used in minibase to help guide service deployment decisions.
* mobile:
personal devices.
* third-party:
remote devices, like a cloud vm, that require delegating trust to a third party.
* secure-boot:
tpm secure boot environment with encrypted disk.
replicate secrets using flakes, repos should only be shared among devices of the same storage class.
Physical network security policies work to restrict the transmission of cleartext data on any physical infrastructure. Internal traffic is routed over self-organizing encrypted links using the yggdrasil router.