Security responsibilities
What NiceRack looks after (power, network, hardware and monitoring) and what you look after on your machine (the OS, updates, firewall and backups).
You own your machine and have full root on it. That splits the work cleanly: we look after everything below the operating system, and you look after the operating system and everything on it.
Who looks after what
| Area | NiceRack | You |
|---|---|---|
| Building and rack | The data center, the rack, physical access and remote hands | — |
| Power and cooling | Power within the agreed envelope, and cooling | — |
| Network | The uplink, and the private Tailscale network the machine is on. No public IP unless you ask for one | Who you share access with, which services listen, and the firewall on the machine |
| Hardware | Monitoring temperature, disks and reachability, and acting when something looks wrong | Telling us when something seems off |
| Managed software | Installing and maintaining our monitoring agents, crash-prevention software and Tailscale | Leaving them installed and running |
| Operating system | Installing the image you chose at racking, and approved reimages | Updates, packages, kernel and configuration |
| Access | Installing your account's SSH keys for root at racking | authorized_keys, users and SSH settings after that |
| Applications | — | Everything you run, and how it's exposed |
| Data | Not backed up unless we've agreed a backup service | Backups, and anything else that keeps your data safe |
What management includes
The management fee of $99 per machine per month covers:
Access
- Full root access
- Private remote access
- Your SSH keys installed for root
- Your choice of OS image, or your own
Network and power
- Shared 1 Gbps port with 2 TB outbound a month
- Power within the agreed envelope, and cooling
Hands and eyes
- Monitoring of temperature, disks and reachability
- Reboots on request
- One approved OS reimage a month
- 15 minutes of remote hands a month
- A four-business-hour response target
Not included unless agreed
- Application uptime guarantees
- Model tuning or application support
- Backups of your data
Software we manage on your machine
Every machine ships with Tailscale, which connects it to our private network, and with NiceRack's monitoring agents and pre-configured software that helps prevent crashes, such as a watchdog that recovers a hung machine and thermal protection.
- What it does: it watches temperature, disks and reachability, recovers the machine from hangs and protects it from overheating, so we can act when something goes wrong.
- What it doesn't do: it doesn't read your data. It reports the machine's health, not its contents.
- What we ask of you: don't remove, disable or reconfigure it, and don't block it with your firewall. Removing or disabling it voids the management guarantees, because we can no longer monitor or reach the machine.
If a managed component gets in the way of your work, write to us and we'll look at it with you.
Your data and backups
Your data is not backed up unless we've agreed a backup service with you. Monitoring watches the hardware; it doesn't protect your data. A disk can fail, and a reimage erases the disk.
- Keep at least one copy of anything important off the machine, for example with
resticorborgbackupto storage you control. - Test a restore now and then. A backup you haven't restored isn't proven.
- Your data stays on the machine until you authorize a wipe, including when we ship it to you or buy it back.
Secure your machine
A short checklist for a new machine:
- Install updates with
apt update && apt full-upgrade, and considerunattended-upgradesfor security updates. - Keep SSH key-only. Leave
PasswordAuthentication noin/etc/ssh/sshd_config.PermitRootLogin prohibit-passwordkeeps root reachable with keys only. - Turn on a firewall. Your machine has no public IP, so only your Tailscale devices can reach it. A firewall still limits what they can reach. With
ufw, allow traffic over Tailscale before you enable it:ufw allow in on tailscale0, thenufw enable. Never block Tailscale itself or outgoing traffic. - Expose as little as possible. Bind model servers, dashboards and databases to
localhostand reach them through an SSH tunnel. Share the machine only with the Tailscale accounts that need it. - Give each person their own key, and remove keys when people leave. See Rotate or remove keys.
Firewall changes can lock you out
Allow Tailscale first and keep your current session open while you test a new rule from a second terminal. If you do lock yourself out, see If you're locked out.
When we work on your machine
Remote hands work on your machine when you ask, or when monitoring shows a hardware problem, and we keep a record of what we do. Your data stays on the machine; nothing is wiped unless you authorize it.
To report a security concern about NiceRack itself, write to contact@nicerack.cloud.
Didn’t find your answer?
Write to us with your machine’s hostname and what you need. Our response target is four business hours.