anomaly / anomaly/lab-python-server
Review `traefik` configuration, preferably implement a completely dynamic configuration
- Lenguaje dominante
- Python
- Estrellas
- 16
- Forks
- 4
- Métricas de merge de PR
- Sin PR fusionados en 30 d
Descripción
**Is your feature request related to a problem? Please describe.**
The current `traefik` configuration is a relic from when the team was working on projects and deploying them via `docker-compose` on `Linode` servers.
The first issues as amongst many of the things that I took handovers on is inconsistency. For example here there are various elements configured via the `dynamic` route and then others via the `static` route.
Here's an extract from the current production `docker-compose` file for production:
```labels
- "--providers.docker"
- "--providers.docker.exposedbydefault=false"
- "--providers.file"
- "--providers.file.filename=/opt/traefik/traefik-dynamic.toml"
```
this shows how there are a couple of different ways configurations are being read.
Further there are various security concerns in the configuration:
- `HSTS` headers are missing
- The configuration allows for older versions `TLS` that are known to have security vulnerabilities
- `X-Frame-Options` to be set to `DENY`
**Describe the solution you'd like**
Ideally we want to use a completely `dynamic` configuration based on the `docker` or `kubernetes` [providers](https://doc.traefik.io/traefik/providers/overview/). A dynamic configuration would allow us to use variables which would make the configuration generic for all our projects.
Secondly we need to review the labels associated to the API container. These are a relic from when the team was working on in the applications in 2021.
Properly review the security requirements of modern web applications:
- [HTTP Strict Transport Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) (HSTS)
- Support good known versions of TLS
The ultimate aim of the template is to achieve `A+` security rating on any testing platform.
> Note this ticket should be updated once a proper review of security standards has been conducted.
**Reverse proxy considerations**
Our configure should provide reverse proxy configurations:
- For containers e.g API or front end [wrapped in container](https://github.com/anomaly/lab-web-client/issues/17) (accompanying [docs](https://github.com/anomaly/lab-web-client#docker-container-for-production))
- Proxying Object stores for serving front end clients and assets (where scale is a factor)
- Considerations for sitting behind a content distribution network
**HSTS configuration**
Label based configuration for HSTS, as [per this article](https://calvin.me/hsts-with-traefik/) (again this is subject to be reviewed after my research)
```
traefik.frontend.headers.STSSeconds: "31536000"
traefik.frontend.headers.STSIncludeSubdomains: "true"
traefik.frontend.headers.STSPreload: "true"
```
**Describe alternatives you've considered**
None as this is the template that should serve our other applications
**Additional context**
As realised with much of the work that was done in 2021, these configurations are uniformed from a security standpoints and should be abandoned and built from the ground up.
Ultimately we should put the configuration through [SSLlabs](https://www.ssllabs.com/ssltest/index.html) and see it meets the A+ requirements of a modern web application.
Guía de contribución
No hay ninguna guía de contribución indexada para este repositorio
Evaluación
Este issue todavía no se ha evaluado.