docs: update infrastructure state and roadmap
This commit is contained in:
+116
-1
@@ -34,16 +34,46 @@ ubuntu
|
||||
|
||||
UFW is enabled and used as the primary host firewall.
|
||||
|
||||
Allowed ports:
|
||||
Verified allowed incoming ports from `sudo ufw status verbose`:
|
||||
|
||||
| Port | Purpose |
|
||||
| ---- | ------- |
|
||||
| 22 | SSH |
|
||||
| 80 | HTTP |
|
||||
| 443 | HTTPS |
|
||||
| 2222 | Gitea Git SSH |
|
||||
| 10000/udp | Jitsi JVB media |
|
||||
| 8085 | Explicitly allowed non-standard TCP port |
|
||||
| 8443 | Explicitly allowed non-standard HTTPS port |
|
||||
| 8444 | Explicitly allowed non-standard TCP port |
|
||||
| 8080 | Explicitly allowed non-standard TCP port |
|
||||
| 32443 | Xray public tunneling endpoint |
|
||||
|
||||
Default policy:
|
||||
|
||||
* deny incoming
|
||||
* allow outgoing
|
||||
* deny routed
|
||||
|
||||
All other ports should remain blocked unless explicitly required.
|
||||
|
||||
Known runtime-published non-standard ports from the 2026-06-24 Docker snapshot:
|
||||
|
||||
| Port | Service | UFW state | Notes |
|
||||
| ---- | ------- | --------- | ----- |
|
||||
| 81 | Nginx Proxy Manager | Not listed as allowed | Admin interface is published by Docker, but not allowed by UFW snapshot |
|
||||
| 2222 | Gitea | Allowed | Git SSH |
|
||||
| 32443 | Xray | Allowed | Public tunneling endpoint |
|
||||
| 5555 | BaGet | Not listed as allowed | Direct HTTP port is published by Docker, but not allowed by UFW snapshot |
|
||||
| 8000 | Jitsi Web | Not listed as allowed | Direct HTTP port is published by Docker, but not allowed by UFW snapshot |
|
||||
| 8443 | Jitsi Web | Allowed | Direct HTTPS port |
|
||||
| 10000/udp | Jitsi JVB | Allowed | Required media bridge traffic |
|
||||
| 8082 | OpenProject | Not listed as allowed | Direct HTTP port is published by Docker, but not allowed by UFW snapshot |
|
||||
|
||||
These ports must either be intentionally allowed and documented in UFW, or blocked at the host firewall if only Nginx Proxy Manager should be public.
|
||||
|
||||
UFW also allows `8080`, `8085` and `8444`, but no matching Docker-published service was identified in the 2026-06-24 Docker snapshot. These rules should be reviewed and removed if they are no longer required.
|
||||
|
||||
---
|
||||
|
||||
## Intrusion Protection
|
||||
@@ -58,6 +88,12 @@ Purpose:
|
||||
* Automatically block malicious IP addresses
|
||||
* Protect SSH access
|
||||
|
||||
Planned improvements:
|
||||
|
||||
* Upgrade Fail2Ban coverage
|
||||
* Add CrowdSec for collaborative intrusion detection
|
||||
* Add Cloudflare rate limiting and WAF for exposed administrative endpoints
|
||||
|
||||
---
|
||||
|
||||
## Secrets Management
|
||||
@@ -100,6 +136,43 @@ All public services should be accessible through HTTPS only.
|
||||
|
||||
---
|
||||
|
||||
## Public Exposure
|
||||
|
||||
Public HTTP and HTTPS services are routed through the `proxy` Docker network and Nginx Proxy Manager.
|
||||
|
||||
Publicly exposed services:
|
||||
|
||||
* Gitea
|
||||
* OpenProject
|
||||
* Portainer
|
||||
* DbGate
|
||||
* Xray
|
||||
* Jitsi Web
|
||||
* BaGet
|
||||
|
||||
High-sensitivity exposure:
|
||||
|
||||
* DbGate exposes a database administration interface and must always require authentication and HTTPS.
|
||||
* Xray exposes tunneling capability and must be monitored for abuse, unexpected traffic and unauthorized use.
|
||||
* Portainer exposes Docker management and must be restricted to trusted administrators.
|
||||
|
||||
Nginx Proxy Manager findings from the 2026-06-24 proxy-host snapshot:
|
||||
|
||||
* No proxy host had an Nginx Proxy Manager access list assigned.
|
||||
* DbGate was enabled without SSL Force, HTTP/2 or HSTS.
|
||||
* Gitea, Jitsi Meet and BaGet were enabled without SSL Force.
|
||||
* Plane.so has been removed from containers, Nginx Proxy Manager and server certificate storage.
|
||||
* `cicd.silveressence.net` is intentionally enabled as a frequently changing prototype deployment endpoint.
|
||||
* `exactsyncer.silveressence.net` is intentionally enabled as a client-facing Exact Online syncer demo endpoint.
|
||||
|
||||
Priority hardening:
|
||||
|
||||
1. Enable SSL Force for all HTTPS public service routes unless there is a documented exception.
|
||||
2. Add an access list or equivalent restriction for DbGate and Portainer.
|
||||
3. Define explicit exposure and authentication expectations for prototype and demo endpoints.
|
||||
|
||||
---
|
||||
|
||||
## Email Security
|
||||
|
||||
Outgoing email is provided through Gmail SMTP.
|
||||
@@ -137,6 +210,7 @@ Future OAuth providers:
|
||||
|
||||
* Google OAuth2
|
||||
* GitHub OAuth2
|
||||
* Authelia SSO for exposed admin areas
|
||||
|
||||
Requirements:
|
||||
|
||||
@@ -144,6 +218,13 @@ Requirements:
|
||||
* Use least-privilege scopes
|
||||
* Disable unused authentication providers
|
||||
|
||||
Planned protected areas:
|
||||
|
||||
* DbGate
|
||||
* Portainer
|
||||
* Gitea administrator areas
|
||||
* OpenProject administrator areas
|
||||
|
||||
### Disabled
|
||||
|
||||
* OpenID authentication
|
||||
@@ -180,6 +261,19 @@ DbGate is the public administration entry point and must require authentication
|
||||
|
||||
---
|
||||
|
||||
## Connectivity Layer Security
|
||||
|
||||
Xray is classified as a network tunneling and connectivity layer, not as an application service.
|
||||
|
||||
Requirements:
|
||||
|
||||
* Keep the Xray service isolated from private database networks unless a documented need exists.
|
||||
* Monitor logs and traffic patterns for abuse.
|
||||
* Review access policy after configuration changes.
|
||||
* Keep secrets, UUIDs, keys and endpoint credentials outside the repository.
|
||||
|
||||
---
|
||||
|
||||
## Docker Security
|
||||
|
||||
Services are isolated through Docker containers.
|
||||
@@ -195,6 +289,16 @@ Networks:
|
||||
|
||||
* proxy
|
||||
* internal
|
||||
* jitsi-docker-jitsi-meet-aa76415_meet.jitsi
|
||||
* xray_default
|
||||
* gitea-runner_default
|
||||
|
||||
Network model:
|
||||
|
||||
* `internal` is for private database and backend traffic.
|
||||
* `proxy` is for public HTTP and HTTPS services controlled by Nginx Proxy Manager.
|
||||
* Isolated stack networks are used for Jitsi, Xray and CI/CD runner separation.
|
||||
* `xray_default` currently exists without a running container attached; the active `xray` container is attached to `proxy`.
|
||||
|
||||
---
|
||||
|
||||
@@ -232,11 +336,20 @@ Periodically verify:
|
||||
* SSH keys are current
|
||||
* Unused accounts are removed
|
||||
* Fail2Ban is active
|
||||
* Planned CrowdSec and Cloudflare WAF status is reviewed
|
||||
* UFW is active
|
||||
* SSL certificates are valid
|
||||
* Secrets are not stored in repositories
|
||||
* Backups are functioning
|
||||
* Administrator accounts have 2FA enabled
|
||||
* DbGate login is enforced
|
||||
* DbGate proxy route has SSL Force and an access restriction policy
|
||||
* Xray exposure policy is still valid
|
||||
* Public services are still routed only through Nginx Proxy Manager
|
||||
* Removed proxy hosts and unused certificates stay removed unless explicitly approved
|
||||
* Prototype and demo proxy hosts have documented owners and exposure expectations
|
||||
* Direct host-published ports are intentional or blocked by UFW
|
||||
* UFW rules `8080`, `8085` and `8444` still have a documented owner
|
||||
* Review application logs
|
||||
* Review Docker logs
|
||||
* Review authentication failures
|
||||
@@ -262,4 +375,6 @@ If a credential is exposed:
|
||||
* docs/secrets.md
|
||||
* docs/backups.md
|
||||
* docs/email.md
|
||||
* docs/network.md
|
||||
* docs/roadmap.md
|
||||
* nginx-proxy-manager/README.md
|
||||
|
||||
Reference in New Issue
Block a user