generated from bisco/codex-bootstrap
bisco
40 lines
2.7 KiB
Markdown
40 lines
2.7 KiB
Markdown
# Security
|
|
|
|
- Wagtail admin uses Django authentication, authorization, sessions, CSRF protection,
|
|
and password hashing. The public site does not add accounts or write endpoints.
|
|
- The aggregate API is intentionally unauthenticated and returns published editorial
|
|
content only; secrets and unpublished drafts must never be serialized.
|
|
- PostgreSQL has no host-published port. NGINX and diagnostic application ports bind to
|
|
loopback for local use. Unknown NGINX virtual hosts are rejected with 404.
|
|
- Containers are unprivileged at the Compose level: no privileged mode, host network,
|
|
Docker socket, or added capabilities are used. `no-new-privileges` is enabled and
|
|
the application images run as non-root users.
|
|
- `.env` is ignored. `.env.example` contains replaceable development placeholders,
|
|
never production credentials. Use a deployment secret manager outside local use.
|
|
- `DJANGO_DEBUG` must be false and allowed hosts explicit outside development. Public
|
|
traffic must use either the optional direct TLS mode or TLS at a load balancer.
|
|
- Database and uploaded media backups may contain personal data. Restrict, encrypt,
|
|
retain, and delete them according to the operator's privacy policy.
|
|
- Avoid placing personal phone numbers or private contact details in logs. The API
|
|
legitimately exposes only contact details approved for publication.
|
|
- Frontend and backend informational/access logs are suppressed by default, reducing
|
|
routine client metadata in application logs without hiding warnings or errors. NGINX
|
|
remains the request-level access log and must receive the same retention controls.
|
|
- Dependency and image versions are explicit. Operators remain responsible for patch
|
|
upgrades, vulnerability scans, and production digest pinning.
|
|
- NGINX forwards the original host and standard client/protocol headers. Django trusts
|
|
`X-Forwarded-Proto: https`; therefore direct proxy access must be limited to trusted
|
|
networks when a load balancer supplies that header. The NGINX mapping accepts only
|
|
the literal `https` value as secure.
|
|
- Optional Certbot uses a pinned image, a read-only root filesystem, no Docker socket,
|
|
and only the certificate/challenge volumes. NGINX reads private keys from the
|
|
certificate volume but cannot modify them. Restrict and back up that volume as
|
|
sensitive material.
|
|
- The Playwright image is pinned and enabled only through the test Compose profile. It
|
|
receives no credentials, publishes no host ports, and tests only the local portal.
|
|
The override uses a separate PostgreSQL volume so its seed cannot overwrite normal
|
|
CMS content.
|
|
|
|
Manual production hardening remains required for proxy trust boundaries, media
|
|
storage, backup retention, monitoring, firewalling, and admin network policy.
|