16 Security and Compliance

Athene security depends on four foundations: encrypted transport, explicit authentication, least-privilege authorization, and disciplined credential lifecycle management.

16.1 Prerequisites

• TLS plan (development certs vs trusted production certs).
• Authentication strategy selected (simple, localhost, or ldap) from 09 Authentication and Tokens.
• Secret-management workflow for CI tokens.
• ACL baseline defined from 07 User and Access Control.

16.2 Quick Start

1. Enable HTTPS and confirm clients connect over TLS.
2. Reduce ATHENE_ALWAYS_ALLOW_CIDRS to strict local-only scope or remove in shared environments.
3. Enforce authenticated access for /athene/** endpoints.
4. Use PATs for automation, not personal account passwords.
5. Restrict write access globally, then grant targeted repository exceptions.
6. Rotate tokens regularly and remove stale credentials.

16.3 Key Parameters Explained

• ATHENE_SSL_ENABLED: enables TLS listener.
• ATHENE_SSL_KEY_STORE, ATHENE_SSL_KEY_STORE_PASSWORD, ATHENE_SSL_KEY_STORE_TYPE, ATHENE_SSL_KEY_ALIAS: certificate and key configuration.
• ATHENE_ALWAYS_ALLOW_CIDRS: bypass list; keep narrow and intentional.
• REPOSITORY_USERNAME / REPOSITORY_PASSWORD: server-side credential gating for repository endpoints.
• access-control.ini and repository.ini: allow/deny policy enforcement points.

Tip

Security drift usually starts with convenience exceptions that never get removed. Time-box every temporary bypass (--ignore-ssl-trust, broad CIDR allow, shared admin credentials) and track cleanup dates.

16.4 Audit and Evidence Checklist

For compliance reviews, keep these artifacts:

• Current authentication config (authentication.ini)
• Current global and per-repo ACL config
• Token rotation and revocation records
• Change log for access policy updates
• Evidence of periodic access validation tests

Next chapter: 17 Troubleshooting Handbook.