Security
Zonal is designed for church environments where IT resources are limited. Security is on by default — you don't need to configure certificates manually unless you want advanced options.
Transport security (mTLS)
All communication between monitors and the controller uses mutual TLS (mTLS). Both sides present certificates, so a rogue device cannot inject SPL data even if it can reach the MQTT port.
On first startup, the controller generates a self-signed CA and issues certificates for itself. When you provision a monitor, a unique certificate is generated and embedded in the provisioning script — no manual certificate management required.
Dashboard authentication
The dashboard requires a username and password on every login. Default credentials are shown once during first-run setup and must be changed immediately.
- Sessions expire after 8 hours of inactivity.
- Failed login attempts are rate-limited (5 attempts per minute per IP).
- The dashboard API uses signed JWT tokens — there are no persistent session cookies.
Network isolation recommendations
| Port | Expose to | Reason |
|---|---|---|
| 4000 (dashboard) | LAN or VPN only | No need to expose to the internet |
| 8883 (MQTT/TLS) | Monitor VLAN only | Only monitors need this |
| 1710 (Q-SYS) | AV VLAN only | Only the Q-SYS Core needs this |
If you use a managed switch, place monitors on a dedicated IoT or AV VLAN and allow only port 8883 outbound to the controller. This prevents a compromised Pi from reaching other network resources.
Certificate rotation
Certificates are valid for 10 years by default. To rotate them (e.g., after a security incident):
- Go to Settings → Security → Certificates → Rotate CA.
- The controller generates a new CA and revokes all existing monitor certificates.
- Re-provision each monitor using the updated provisioning script from the dashboard.
License key security
Your license key (SPL-XXXX-XXXX-XXXX-XXXX) is tied to the machine that first activates it. Keep it private — anyone with the key can activate it on a different machine, which will invalidate your current activation.
If your key is compromised, email [email protected] and we will issue a replacement.
Reporting a vulnerability
Please do not open public GitHub issues for security vulnerabilities. Email [email protected] with a description and steps to reproduce. We aim to acknowledge reports within 48 hours.