I'm deploying a nodejs-based website for someone. It will be low traffic, but I want to make sure I've got all my bases covered in terms of best practices for deployment and security. This is what I've got so far:
- Code is hosted in private repo on private gitea instance
- build into a docker image
- Separate repo for all deployment code using ansible
- secrets are saved in a vault and templated to the host
- Runs on dedicated host with dedicated ipv4
- host has fail2ban installed and firewalled to only allow ports 80/443 and shh
- ssh hardened
- non-standard port
- public key auth only
- images are run on docker
- non-root user
- one network for app+db, another for app+reverse proxy
- only mapped ports are 80/443 on reverse proxy container
- using swag for reverse proxy (includes fail2ban and letsencrypt)
- backups
- database dumped nightly
- everything synced to backblaze (wip)
What else should I be doing? The one thing I know I don't have is any monitoring. I'm going to set up some kind of healthcheck, but not sure if there's anything easy to set up wrt log monitoring...
Thanks!
Also docker repo but mainly because I use Jeff Geerlings ansible role for installing docker. I pin the version, so it's not really much different from using the Debian repo