173 lines
6.1 KiB
Markdown
173 lines
6.1 KiB
Markdown
# Docker Security Configuration
|
|
|
|
## Overview
|
|
|
|
The drone detection system uses a multi-layered security approach with different configurations for development and production environments.
|
|
|
|
## Security Layers
|
|
|
|
### 🔒 **Internal-Only Services (No External Access)**
|
|
|
|
#### 1. PostgreSQL Database
|
|
- **Risk**: Direct database access from internet
|
|
- **Security**: Only accessible via Docker internal network
|
|
- **Development**: Port 5433 exposed via override file
|
|
- **Production**: No external ports
|
|
|
|
#### 2. Redis Cache/Sessions
|
|
- **Risk**: Session data and cache accessible from internet
|
|
- **Security**: Only accessible via Docker internal network
|
|
- **Development**: Port 6380 exposed via override file
|
|
- **Production**: No external ports, password protected
|
|
|
|
#### 3. Data Retention Service
|
|
- **Risk**: System metrics and cleanup data exposure
|
|
- **Security**: Only accessible via management portal with authentication
|
|
- **Development**: Port 3004 can be exposed for testing
|
|
- **Production**: No external ports
|
|
|
|
#### 4. Backend API (Production)
|
|
- **Risk**: Direct API access bypassing reverse proxy
|
|
- **Security**: Only accessible via nginx reverse proxy in production
|
|
- **Development**: Port 3002 exposed for direct access
|
|
- **Production**: No external ports
|
|
|
|
### 🌐 **Public-Facing Services (External Access)**
|
|
|
|
#### 1. Frontend Application
|
|
- **Port**: 3001 (development) / 80 via nginx (production)
|
|
- **Purpose**: User interface for tenant users
|
|
- **Security**: Static files only, no sensitive data
|
|
|
|
#### 2. Management Portal
|
|
- **Port**: 3003 (development) / 80 via nginx (production)
|
|
- **Purpose**: Administrative interface
|
|
- **Security**: Authentication required, role-based access
|
|
|
|
#### 3. Nginx Reverse Proxy (Production)
|
|
- **Ports**: 8080 (HTTP), 8443 (HTTPS)
|
|
- **Purpose**: Single entry point for all services
|
|
- **Security**: SSL termination, request filtering
|
|
|
|
## Configuration Files
|
|
|
|
### Base Configuration: `docker-compose.yml`
|
|
- **Purpose**: Secure baseline configuration
|
|
- **Security**: All internal services locked down
|
|
- **Database**: No external ports
|
|
- **Redis**: No external ports
|
|
- **Data Retention**: No external ports
|
|
|
|
### Development Override: `docker-compose.override.yml`
|
|
- **Purpose**: Development convenience
|
|
- **Security**: Exposes internal services for debugging
|
|
- **Usage**: `docker-compose up` (automatically uses override)
|
|
- **Warning**: ⚠️ Never deploy to production with override file
|
|
|
|
### Production Configuration: `docker-compose.prod.yml`
|
|
- **Purpose**: Maximum security for production
|
|
- **Security**: All services internal-only except nginx
|
|
- **Usage**: `docker-compose -f docker-compose.yml -f docker-compose.prod.yml up`
|
|
- **Features**: Password protection, SSL, enhanced logging
|
|
|
|
## Deployment Commands
|
|
|
|
### Development (Less Secure, More Convenient)
|
|
```bash
|
|
# Uses docker-compose.yml + docker-compose.override.yml
|
|
docker-compose up -d
|
|
|
|
# Direct database access available on localhost:5433
|
|
# Direct Redis access available on localhost:6380
|
|
# Direct backend access available on localhost:3002
|
|
```
|
|
|
|
### Production (Maximum Security)
|
|
```bash
|
|
# Uses docker-compose.yml + docker-compose.prod.yml
|
|
docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d
|
|
|
|
# No direct database access
|
|
# No direct Redis access
|
|
# No direct backend access
|
|
# All access via nginx reverse proxy only
|
|
```
|
|
|
|
### Staging/Testing (Secure but with Monitoring)
|
|
```bash
|
|
# Uses base configuration only
|
|
docker-compose -f docker-compose.yml up -d
|
|
|
|
# Secure but allows manual inspection if needed
|
|
```
|
|
|
|
## Security Checklist
|
|
|
|
### ✅ **Applied Security Measures**
|
|
|
|
- **Database Isolation**: PostgreSQL not externally accessible
|
|
- **Cache Security**: Redis internal-only with authentication
|
|
- **API Protection**: Backend only accessible via reverse proxy in production
|
|
- **Metrics Security**: Data retention metrics require management authentication
|
|
- **Network Segmentation**: All services on isolated Docker network
|
|
- **Access Control**: Role-based permissions for sensitive endpoints
|
|
- **Audit Logging**: All data retention access logged
|
|
- **Security Headers**: Applied to all management endpoints
|
|
|
|
### 🔍 **Additional Security Recommendations**
|
|
|
|
#### Network Security
|
|
- **Firewall**: Configure host firewall to only allow necessary ports
|
|
- **VPN**: Consider VPN access for management interfaces
|
|
- **IP Allowlisting**: Restrict management portal access by IP
|
|
|
|
#### Database Security
|
|
- **Encryption**: Enable TLS for database connections
|
|
- **Backup Encryption**: Encrypt database backups
|
|
- **User Permissions**: Use least-privilege database users
|
|
|
|
#### Application Security
|
|
- **JWT Secrets**: Use strong, unique JWT secrets
|
|
- **Session Security**: Configure secure session settings
|
|
- **Rate Limiting**: Enable rate limiting on all endpoints
|
|
|
|
#### Container Security
|
|
- **Image Scanning**: Scan container images for vulnerabilities
|
|
- **User Permissions**: Run containers as non-root users
|
|
- **Resource Limits**: Set memory and CPU limits
|
|
|
|
## Emergency Access
|
|
|
|
### Development Database Access
|
|
```bash
|
|
# Connect to development database (when override is active)
|
|
psql -h localhost -p 5433 -U postgres -d drone_detection
|
|
```
|
|
|
|
### Production Database Access (Emergency Only)
|
|
```bash
|
|
# Temporarily expose database for emergency access
|
|
docker-compose -f docker-compose.yml -f docker-compose.override.yml up -d postgres
|
|
|
|
# Connect and then immediately remove override
|
|
psql -h localhost -p 5433 -U postgres -d drone_detection
|
|
|
|
# Restore production security
|
|
docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d
|
|
```
|
|
|
|
## Monitoring & Alerting
|
|
|
|
### Security Events to Monitor
|
|
- **Unauthorized Access**: Failed authentication attempts on management portal
|
|
- **Data Retention Access**: All access to system metrics endpoints
|
|
- **Database Connections**: Unusual database connection patterns
|
|
- **Network Traffic**: Unexpected traffic to internal services
|
|
|
|
### Log Locations
|
|
- **Security Logs**: `/app/logs/data_retention_access.log`
|
|
- **Application Logs**: Container logs via `docker-compose logs`
|
|
- **Database Logs**: PostgreSQL container logs
|
|
- **Nginx Logs**: Reverse proxy access logs
|
|
|
|
This security configuration ensures that sensitive infrastructure components are isolated while maintaining operational flexibility for different environments. |