Network Security
WireGuard VPN Encryption
Section titled “WireGuard VPN Encryption”All Swarm traffic between Azure and Contabo travels through the WireGuard VPN tunnel, which provides:
- Encryption: ChaCha20-Poly1305
- Key exchange: Curve25519
- Port: UDP 51820
- Mutual authentication: Both peers have each other’s public keys
The WireGuard config is at /etc/wireguard/wg0.conf on Contabo.
SSL / TLS
Section titled “SSL / TLS”All public-facing services use HTTPS with Let’s Encrypt wildcard certificates.
| Property | Value |
|---|---|
| Certificate | Let’s Encrypt wildcard |
| Domain | *.ayinza.dev |
| Key location | /etc/letsencrypt/live/ayinza.dev/ |
| Termination | At Nginx (not at individual services) |
| Internal traffic | Unencrypted (within Docker overlay network) |
See SSL Certificates for the renewal process.
Network Segmentation
Section titled “Network Segmentation”Docker overlay networks provide service isolation:
| Network | Services | Purpose |
|---|---|---|
dev_sseris-network | All DEV services | DEV isolation |
sseris-uat-network | All UAT services | UAT isolation |
shared_harbor | Harbor, Nexus, Portainer | Shared services |
- DEV services cannot directly reach UAT services and vice versa
- Nginx sits on all three networks to route traffic to any service
- Services communicate by DNS name within their overlay network
Exposed Ports
Section titled “Exposed Ports”Only these ports are published to the public internet:
| Port | Protocol | Service | Node |
|---|---|---|---|
| 22 | TCP | SSH | Both |
| 80 | TCP | Nginx (→ HTTPS redirect) | Both |
| 443 | TCP | Nginx (HTTPS) | Both |
| 51820 | UDP | WireGuard | Contabo |
| 5432 | TCP | PostgreSQL DEV | Azure |
| 5433 | TCP | PostgreSQL UAT | Contabo |
| 8082 | TCP | Nexus | Contabo |