Security

Security is "Day Zero" in Proxus.

Network Security

• NATS/JetStream: Always use TLS 1.3 for the connection between Edge and Central.
• Firewall: Edge Gateways only need outbound 443 (HTTPS) and 4222 (NATS) access. No inbound ports required.

Device Security

• MQTT Auth: Devices must authenticate with a Token.
• Isolation: The FunctionActor sandboxes user scripts to prevent system access.

User Management

• RBAC: Role-Based Access Control for the Central UI.
• Audit Logs: All configuration changes are logged with User ID and Timestamp.