Security & Firewall

Two-layer network protection so only your API server can reach the databases.

Security Model

Internet / random IPs  ──X──►  DB ports (blocked)
API server 72.60.223.44 ──✓──►  DB ports (allowed)
Admin                     ──✓──►  SSH port 22
Anyone                    ──✓──►  HTTP/HTTPS 80/443 (wiki + admin)

Layer 1 — UFW Firewall

Layer 2 — DOCKER-USER Chain

Docker can bypass UFW. The DOCKER-USER iptables chain enforces the same IP restriction:

1. Established connection → allow
2. From 72.60.223.44 → allow
3. Everything else → drop

Application Security Rules

• Never put DB credentials in frontend or mobile code
• Never commit .env to git
• Use app-specific users — not postgres / admin / neo4j root
• Use parameterized queries (SQL, Cypher) and driver methods (Mongo)
• Do not expose raw DB errors to API clients
• Use connection pooling on all databases
• Enable TLS if traffic crosses untrusted networks

Per-App Isolation

What Is NOT Exposed

• Neo4j browser UI (port 7474)
• DB ports to the public internet
• Root/admin credentials to app developers