Operations

Security Hardening

Recommended security configuration for production Drevnix deployments.

Using an AI assistant? Give it this file.

/llms.md is a single Markdown file covering installation, configuration, quickstart, clients, upstreams, permissions, TLS, and production deployment. Copy it and paste it into your AI chat, or tell the AI to fetch https://drevnix.tech/llms.md.

Security Hardening

Network isolation

Expose only what needs to be public:

Port	Exposure
`:8000` (proxy)	Public (Docker clients reach this)
`:8001` (portal)	Internal / VPN only
`:8002` (REST API)	Internal / VPN only

AWS security group example:

Inbound:
  8000 — from developer/CI IP ranges
  8001 — from VPN CIDR only
  8002 — from VPN CIDR only

Outbound:
  443 — to upstream registries (ghcr.io, docker.io, etc.)

ENCRYPTION_KEY

The ENCRYPTION_KEY encrypts all upstream registry credentials at rest using AES256-GCM.

Generate with openssl rand -hex 32
Store in a secrets manager (AWS Secrets Manager, HashiCorp Vault), not in a .env file or source control
Back it up. Losing it makes all stored upstream credentials unreadable
To rotate it, use the change-encryption-key CLI command

TLS everywhere

Put a reverse proxy (nginx, Caddy, Traefik) in front of all three ports. See TLS / HTTPS for examples. Never expose Drevnix ports directly over HTTP on a public network.

Rate limiting

Drevnix applies in-memory rate limiting to both the portal login endpoint and the proxy’s authentication endpoint. After 5 failed attempts within a 15-minute window, the offending username/IP combination is locked out for 15 minutes. Successful authentication resets the failure counter.

This mitigates credential stuffing without any configuration.

Least-privilege client permissions

Grant each client access to only the images it actually needs:

# Too broad — avoid unless necessary
ghcr/*

# Scoped to org — acceptable
ghcr/myorg/*

# Minimal — preferred for production pipelines
ghcr/myorg/payments

Review client permissions periodically and delete unused clients immediately.

Client expiration dates

Set expiration dates on:

All contractor and third-party clients
CI clients for ephemeral environments
Any client that should not be permanent

Expired clients automatically return 401. No manual revocation needed.

PostgreSQL connection security

Use sslmode=require for any remote PostgreSQL:

JDBC_URL=jdbc:postgresql://host:5432/drevnix?ssl=true&sslmode=require

Audit log review

Periodically review the audit log for:

Unexpected 403 responses: may indicate a misconfigured client or a probing attempt
Access to sensitive upstreams (e.g. ecr-prod) from unexpected clients
Unexpected client IDs: may indicate leaked credentials

Set AUDIT_RETENTION_DAYS to at least 90, or longer if required by your compliance framework.