• lntl@lemmy.mlEnglish
    7·
    2 days ago

    I operate SSH, nginx, and uvicorn like this:

    SSH

    • pubkey auth only
    • not on default port
    • AllowUsers var in sshd.conf is set

    nginx

    • runs as its own user
    • serves static files or forwards to uvicorn
    • rate limits are set
    • returns 444 on requests that aren’t in sitemap.xml (nonsense and probing)

    uvicorn

    • runs as its own user

    and a firewall runs on top of everything in a hardened kernel. I’m self taught, so I could be missing something obvious and this setup has been reliable for me for a few years.

    • jello@programming.devEnglish
      3·
      2 days ago

      Do you have any sort of access limiting, either by whitelist (e.g. Tailscale), or blacklist (e.g. Crowd-Sec)?

      • lntl@lemmy.mlEnglish
        3·
        2 days ago

        Nope, I’m accessible on the WAN and the webserver is intentionally public facing.

        Edit: AllowUsers in sshd.conf is my access control