What Runs Where, What Goes Where
The master and agents are your processes on your hosts. Results go from the master straight to the PostgreSQL, InfluxDB, Elasticsearch or Prometheus you operate. trcr.dev issues licences and, if you leave the heartbeat on, hears from the master about once an hour.
| Sent to api.trcr.dev (heartbeat, optional) | Never leaves your infrastructure |
|---|---|
| Licence ID and tier | Probe targets and inventory |
| Daemon version | Probe results and metrics |
| Machine fingerprint of the master | Network topology and agent addresses |
| Agent count and uptime | Alert rules, dashboards, credentials |
Set heartbeat.enabled: false for a fully air-gapped deployment; licence expiry is enforced by the local clock, and probes keep running if the heartbeat cannot reach us.
How the Daemon Protects Itself
No root
The daemon runs as an unprivileged user. ICMP ping and traceroute need raw sockets, so the systemd units grant CAP_NET_RAW to the service and nothing else; the ping engine tries unprivileged datagram ICMP first. An agent that only runs HTTP, DNS, TCP or TLS probes can drop the capability.
Mutual TLS 1.3 only
The master is the deployment's certificate authority (ECDSA P-256). Every agent holds a 365-day certificate issued at enrolment and renewed automatically at 75% of its lifetime; the master's own serving certificate is reissued in place 30 days before expiry. Both sides verify each other on every connection.
Enrolment you control
An agent joins with a single-use token (one hour by default) or a pairing code the master claims. The CA refuses any agent certificate naming the master itself, and a renewal can keep names but never acquire them, so an enrolled agent cannot impersonate the master to its peers. Revoking an agent takes effect on a running master within 5 seconds.
Results attributed by certificate
Every result batch is keyed on the certificate that delivered it, not on a field the agent filled in. Each agent receives only the probes it is responsible for, so credentials for one site's probes are never served to another site's agent.
Signed licences, local enforcement
A licence is a JSON document with an Ed25519 signature over its canonical form. The master verifies it against embedded public keys at startup and checks expiry against the local clock; a revocation list is fetched only through a successful heartbeat. Production binaries reject development-signed licences.
Secrets stay out of YAML
Database passwords and SNMP credentials are named by environment variable, and probe secrets can be sealed with trcrd encrypt-password so the configuration file holds ciphertext. Values are never logged; environment overrides are logged by name only.
Outbound guard
HTTP, TCP, TLS, NTP and explicit-resolver DNS probes refuse loopback, link-local, private, carrier-grade NAT, multicast and reserved addresses, checked on the resolved address at dial time so redirects and DNS rebinding are covered. Probes that genuinely watch private infrastructure opt in per probe.
Bounded resource use
Intervals are at least 5 seconds (1 second for ping), packet counts at most 100 per run, concurrency at most 256 per agent, and header sizes capped. The bounds are enforced by trcrd validate and again on the agent when an assignment arrives, so neither a mistake nor a hostile master can turn the fleet into a flood source.
Signed releases
Every release ships a SHA256SUMS file and a detached signature; the installer verifies the signature with the public key embedded in it before trusting a single checksum. Binaries are static, pure Go, built from a tagged commit. The container image is the same binary.
trcr.dev Itself
trcr.dev and the customer portal are served over HTTPS only, with HTTP Strict Transport Security (one year, subdomains included, preload), a Content Security Policy that allows only nonce-marked scripts, and no third-party scripts beyond self-hosted analytics. Portal sessions are server-side, time-limited and require a fresh sign-in after 12 hours. Every administrative action is written to an append-only audit log.
We do not currently claim SOC 2 or ISO 27001 certification. Procurement and security questionnaires can be sent to [email protected].
Tell Us First
If you believe you have found a security problem in the daemon, the installer, the container image, this website or the portal, email [email protected] with the subject "Security report". Include the trcrd version output, the steps to reproduce, and what you observed. Please give us a reasonable time to fix the issue before publishing it; we will keep you informed and credit you if you wish.
The machine-readable version of this policy is at /.well-known/security.txt (RFC 9116).
Published by NameVerse, Inc., 425 Page Mill Rd, Suite 200, Palo Alto, CA 94306, United States.
Further detail: the security chapter of the documentation.