Review production security settings

[mitchellchou]

No description provided.

[rickmak]

I think we just open port 22, 80, 443 and 6443.

6443 Is the most complex and attack prone as it host the complex software which keep evolving.

Port 22/80/443 should be safe with regular updates, as they are bind to a mature software.

[mitchellchou]

blocked as we are using pandawork for production right now

[rickmak]

Since the DB is public facing and not in VPS, we will have postgres port 5432 open only to the IP of the app server and the /etc/postgresql/14/main/pg_hba.conf as specific as possible for only user and database going to connect via network. SSL will need to be enable or using cheap VPN via software like autossh.