Operate your server

Security model

Enrolling a machine gives your Oh My Job server the ability to dispatch commands to it. Protect the server as carefully as the machines it controls.

Trust the administrator

An administrator can define commands that enrolled agents execute. Only give server access to people you trust to operate those machines.

Keep permissions narrow

The standard installation uses a dedicated ohmyjob service user. Give the execution user access only to the files and commands a job needs. Avoid running the whole agent as root simply to make one command work.

Consult the current server security reference and agent security reference when configuring execution users or privileged jobs.

Protect the connection

Use HTTPS when traffic leaves a trusted local network. Agents initiate outbound connections, but the server still needs a reachable, protected address. Follow the reverse proxy guide when placing the server behind a proxy.

Keep enrollment tokens and agent credentials private. Avoid printing secrets in job output: the server retains that output as part of the run history.

Report a vulnerability

Email security@ohmyjob.sh for security reports. See the project’s security policy for reporting guidance.