Security as layers, not as a wall
Anything exposed to the open internet is scanned around the clock — that is not a threat scenario, it is the normal state. The answer is not a single wall but a chain of independent controls: filter before computing, check before rolling out, and look regularly for what was missed. This page describes the principles on purpose — the configuration stays inside.
🧅Several independent layers
Every request passes edge filtering, transport encryption, the reverse proxy and the login gate in turn. None of those layers has to be perfect — they only have to fail independently, so a flaw in one does not carry the next one with it.
🚦Filter before computing
At the very front sit a rate limit and a reputation filter that turns away known scanner and attacker addresses before an application ever sees them. It was introduced first where a false positive costs nothing — and deliberately not where it could cut off the path to fixing it.
📜Strict rules in the browser
The browser is told what it may load at all: nothing from foreign servers, no embedded scripts. Fonts are therefore self-hosted on the same server — and as a side effect, opening this page discloses no IP address to a third party.
🧪Checked before it ships
Every change runs through a pipeline that scans configuration and container images for known weaknesses automatically. The same inventory is scanned again while running — otherwise a weakness that only becomes known after the rollout would stay invisible.
🔑Secrets do not belong in Git
Credentials live in the self-hosted password vault and are distributed from there into file-based secrets, instead of sitting as environment variables inside every container. Version control never holds a password, only the pointer to one.
🗺️Measured, not guessed
The defensive posture is reviewed regularly against an established catalogue of defensive measures. What is missing becomes a tracked task — including the uncomfortable part of making blind spots visible in the first place.