Skip to main content
Vulpy Commerce is designed to be safe by default on a fresh VPS. This page covers the hardening model, Fox isolation, network locks, and the checklist you should verify before going live.
Ask Fox to audit your dev shop. Fox can walk the hardening checklist and tell you what’s missing before you replicate it to staging and live.Try prompts like:
  • “Audit my dev shop against the hardening checklist.”
  • “Explain the split Tailscale identities.”
  • “Is basic auth on Fox configured?”

​
Deploy user model

Day-2 commands run as the vulpy-commerce user, never as root. After installation, switch to that user for all maintenance:
The checkout lives at /home/vulpy-commerce/vulpy-commerce. Running commands as root can break file ownership and prevent Fox from operating correctly.

​
Fox isolation

Fox runs inside its own container with deliberate restrictions:
  • No Docker socket: Fox cannot start or stop other containers. Environment commands such as pnpm vulpy env add, up, down, and golive refuse to run inside the Fox container.
  • Hidden staging and live directories: Staging and live environment directories are not mounted into Fox’s filesystem, so the AI operator cannot read or modify production data.

​
IMDS lock (AWS)

On AWS, the instance metadata service (IMDS) is blocked by default with an nftables reject rule. This prevents container-escaped processes from reaching 169.254.169.254.
  • Enabled by default via VULPY_IMDS_LOCK=1.
  • Opt out with VULPY_IMDS_LOCK=0 if you have a specific need.
  • Verify the rule is active with pnpm vulpy hermes doctor.
For details, see IMDS lock.

​
Host egress lock

The host egress lock restricts outbound traffic patterns and is reported by pnpm vulpy hermes doctor. Run the doctor command after install to confirm the lock is in place.

​
Tailscale split identities

Fox and the host should run on separate Tailscale devices. This limits lateral movement if one identity is compromised. Fox uses its own Tailscale sidecar for HTTPS, while the host uses a separate device for SSH and management. For setup instructions, see Tailscale access.

​
Agent-risk disclaimer

The install wizard requires you to type yes to acknowledge agent risk before setup begins. For unattended installs, pass --i-understand-agent-risk. This confirms you understand that an AI agent with file-system access carries inherent risk and that you have reviewed the isolation measures above.

​
Secrets management

  • Keep secrets in environments/<name>/.env. These files are generated locally and must never be committed to git.
  • Rotate keys and tokens at the provider dashboard (Stripe, SendGrid, and so on) rather than editing them in place.
  • Use pnpm vulpy env sync to copy secrets between environments when needed.

​
Basic auth on Fox

The Fox WebUI is protected by basic authentication. Verify it is working with:
If basic auth is missing or misconfigured, verify will flag it.

​
Quick hardening checklist

1

Deploy user in place

Confirm you are running commands as vulpy-commerce, not root.
2

IMDS lock verified

Run pnpm vulpy hermes doctor and confirm the IMDS lock is active.
3

Fox on its own Tailscale identity

Check the Tailscale admin console: Fox and the host appear as separate devices.
4

Secrets not committed

Run git status and confirm environments/ is ignored.
5

Basic auth working

Run pnpm vulpy verify and confirm Fox basic auth passes.
6

Backups running

Schedule or manually run pnpm vulpy env backup <name> before going live.

Backup and restore

Take backups before hardening changes and before going live.

IMDS lock

Learn how the IMDS lock works and when to disable it.