Security hardening

Work through this before a Nexus instance carries production traffic. The defaults are chosen so a Nexus instance is reachable on first contact, not so it is hardened — those are different goals, and only you know which network this machine is on.

Checklist

Network and transport

• [ ] Install a real TLS certificate. How.
• [ ] Turn off plain HTTP with gateway.httpDisable, unless a proxy in front of you terminates TLS.
• [ ] Restrict bindAddress if Nexus does not need to answer on every interface. It defaults to 0.0.0.0.
• [ ] Confirm the firewall rules. The Windows installer creates program-scoped rules on the Private and Domain profiles and never Public. Verify no rule was widened by hand: Get-NetFirewallRule -DisplayName 'Raylux*' | Select DisplayName, Profile, Enabled
• [ ] Do not expose Nexus to the internet. If remote access is required, put it behind a VPN. There is no rate limiting on the sign-in page beyond a basic limiter, and nothing is code-signed yet.

Accounts

• [ ] Delete raylux_first_boot.txt from the data directory. It is inert once an administrator exists, but there is no reason to leave it.
• [ ] Create a second administrator. There is no password-recovery path — a Nexus with one administrator and a forgotten password needs its user file edited by hand on the server.
• [ ] Give every person their own account. The audit log records who wrote to which tag; a shared login makes that record worthless.
• [ ] Use the narrowest role that works. Designers need designer rights, not Nexus configuration rights. Operators need neither.
• [ ] Review accounts when someone leaves.

Devices and writes

• [ ] Review which tags are writable, and by whom. Write permission is per-tag, not just per-user.
• [ ] Check the write rate limits on anything an operator screen can drive.
• [ ] Review publicRead tags. A tag marked public read is readable without signing in — that is the point, for a plant-floor display with no login, but confirm the list is what you intended.
• [ ] Leave OPC-UA on SignAndEncrypt unless a device genuinely cannot do it. It is the default.

Scripting

• [ ] Leave the script sandbox on. It is the default. Turning it off gives project scripts the run of the machine, as the service account.
• [ ] Review who can edit scripts — that is equivalent to running code on Nexus.

Operations

• [ ] Set up backups and verify a restore.
• [ ] Point monitoring at /health/ready.
• [ ] Review the audit log periodically. It records configuration changes and tag writes with old and new values.
• [ ] Restrict access to the data directory on the server. It contains the TLS private key, secrets and the historian.

Known gaps

Be aware of these when assessing Nexus. None has a workaround inside the product today.

Gap	What it means for you
Nothing is code-signed.	SmartScreen warns on the installer, and application-control policies may block it. Verify downloads out of band.
The Windows service runs as LocalSystem.	More privilege than Nexus needs. A specific service account can be registered instead, but you must then grant it access to the data directory yourself.
No password recovery.	Losing the last administrator password means hand-editing the user file on the server.
No configuration migration across format changes.	Plan upgrades with a backup and a tested rollback.
OPC-UA has not been verified against third-party hardware.	Test your specific server before commissioning depends on it.

Where the audit log lives

In the data directory, and readable in the browser by an administrator. It is not forwarded to a SIEM — there is no syslog or Windows Event Log integration yet, so if you need central collection, collect the file.