NeXuS

Network Security

NeXuS enforces strict network isolation using Docker’s networking features.

Network Architecture

┌──────────────────────────────────────────┐
│              traefik-public              │
│           (external network)             │
│                                          │
│   All public services connect here       │
│   Traefik routes HTTPS traffic           │
└──────────────────┬───────────────────────┘
                   │
                   │ dual-homed services
                   │
┌──────────────────▼───────────────────────┐
│              nexus-internal              │
│        (bridge, internal: true)          │
│                                          │
│   Databases: PostgreSQL, MongoDB,        │
│              Redis, Memcached            │
│                                          │
│   ⛔ No external routing allowed         │
└──────────────────────────────────────────┘

Key Principles

Database Isolation

All databases run exclusively on the nexus-internal network:

networks:
  nexus-internal:
    driver: bridge
    internal: true  # No external routing allowed

The internal: true flag means:

• No outbound internet access from database containers
• No inbound access except from other containers on the same network
• Databases cannot be reached from the host network

No Exposed Ports

No container maps ports to the Docker host in production. All traffic flows through Traefik:

Client → Cloudflare (443) → Traefik (443) → Container (internal port)

No Traefik Labels on Databases

Database containers have no Traefik labels, ensuring they are never accidentally exposed:

postgres:
  networks:
    - nexus-internal  # ← internal ONLY, not traefik-public
  # NO traefik labels - databases are never public

Database Authentication

PostgreSQL

environment:
  POSTGRES_HOST_AUTH_METHOD: scram-sha-256

Uses SCRAM-SHA-256 authentication (no trust-based auth).

Redis

command: >
  redis-server
  --requirepass ${REDIS_PASSWORD}
  --protected-mode yes

Password required for all connections, protected mode enabled.

MongoDB

environment:
  MONGO_INITDB_ROOT_USERNAME: seb
  MONGO_INITDB_ROOT_PASSWORD: ${MONGODB_PASSWORD}

Root authentication required.

Service-to-Database Communication

Application services connect to both networks:

api:
  networks:
    - traefik-public    # Receive external traffic
    - nexus-internal    # Access databases

This allows them to:

1. Accept HTTPS requests from Traefik (via traefik-public)
2. Connect to databases (via nexus-internal)

Cloudflare Protection

All public DNS records should be proxied through Cloudflare (orange cloud) for:

• DDoS protection
• Edge WAF
• SSL/TLS at the edge
• IP masking (your server IP is hidden)

This site is open source. Improve this page.