Skip to content

Network Security

All Swarm traffic between Azure and Contabo travels through the WireGuard VPN tunnel, which provides:

  • Encryption: ChaCha20-Poly1305
  • Key exchange: Curve25519
  • Port: UDP 51820
  • Mutual authentication: Both peers have each other’s public keys

The WireGuard config is at /etc/wireguard/wg0.conf on Contabo.

All public-facing services use HTTPS with Let’s Encrypt wildcard certificates.

PropertyValue
CertificateLet’s Encrypt wildcard
Domain*.ayinza.dev
Key location/etc/letsencrypt/live/ayinza.dev/
TerminationAt Nginx (not at individual services)
Internal trafficUnencrypted (within Docker overlay network)

See SSL Certificates for the renewal process.

Docker overlay networks provide service isolation:

NetworkServicesPurpose
dev_sseris-networkAll DEV servicesDEV isolation
sseris-uat-networkAll UAT servicesUAT isolation
shared_harborHarbor, Nexus, PortainerShared services
  • DEV services cannot directly reach UAT services and vice versa
  • Nginx sits on all three networks to route traffic to any service
  • Services communicate by DNS name within their overlay network

Only these ports are published to the public internet:

PortProtocolServiceNode
22TCPSSHBoth
80TCPNginx (→ HTTPS redirect)Both
443TCPNginx (HTTPS)Both
51820UDPWireGuardContabo
5432TCPPostgreSQL DEVAzure
5433TCPPostgreSQL UATContabo
8082TCPNexusContabo