Safety switches

TrixOS manages real machines, so several safeguards are built in. Some are switches you set; the rest always apply.

Switches

Setting	Default	Effect
TRIXOS_ALLOW_DESTRUCTIVE	false (the install script sets true)	While false, every call that would change hardware (power, boot order, BMC commands, switch ports) is only logged as DRY-RUN: would call …. Jobs still run through all their steps and are marked as dry-run; the UI shows a banner. Read-only calls (power state, sensors, inventory) work normally.
PXE_ENABLED	false	DHCP and TFTP on the panel itself (Compose profile pxe). Not needed when site agents serve PXE. When on, only the MAC addresses of servers with an armed job get an answer, and TrixOS never serves DNS.
PXE_DHCP_MODE	authoritative	proxy only adds PXE options next to an existing DHCP server instead of handing out addresses.
TRIXOS_ALLOW_PRIVATE_URLS	false	While false, custom ISO downloads and webhooks may only reach public addresses, not private, loopback, link-local or cloud metadata addresses.

Settings shows the current state of these switches.

Going live is done in this order: test everything in dry-run, set up PXE (site agents or PXE_ENABLED), then set TRIXOS_ALLOW_DESTRUCTIVE=true.

Always on

• Typed confirmation. Destructive actions (power off, reset, cycle, reinstall, rescue, wipe, password reset, port shutdown) require the server’s hostname, in the UI and in the API ("confirm": "<hostname>").
• One hardware job per server. A second destructive job for the same server is refused (409 LOCKED) until the first one ends.
• Armed MACs only. PXE answers exist only while a job is armed for that server, on the agent and on the panel. When the job ends, its boot URLs stop working.
• No cut-off installers. At the end of an install, the job waits for the installer to power the server off before it changes the boot order and powers it on again.
• Public IPv4 for PXE. PXE jobs are refused for servers without a public IPv4 address.
• Scoped API tokens. Every request with a token is checked against the token’s scopes.
• License checks in every process. The API, the worker, the poller and PXE each verify the signed lease; see Licensing.
• Encrypted secrets. BMC, switch and webhook credentials, TOTP secrets and job secrets such as root passwords are encrypted with AES-256-GCM using TRIXOS_MASTER_KEY, bound to their record.
• No secrets on the command line or in logs. ipmitool gets the password through its environment, and logs redact passwords, tokens, cookies and SNMP communities.