Network Security and Monitoring Policy
Organisation: tolinax UG (haftungsbeschränkt), operator of the aYOUne platform
Status: Approved by the Managing Director and published. Version 1.0, effective 2026-10-14
Owner: Managing Director
Review cycle: at least annually
1. Architecture (implemented)
- Production runs on Google Kubernetes Engine in europe-west3 (Frankfurt, Germany). The database is a managed MongoDB Atlas cluster in the same region.
- All inbound internet traffic enters through a single service-mesh ingress gateway (Istio). Services are not exposed individually to the internet; only explicitly routed hostnames are reachable.
- Workload classes are separated: crawler workloads run on a dedicated, tainted node pool, isolated from API and worker workloads.
- Real-time media and remote-support relays that need raw TCP/UDP run in their own namespaces behind dedicated load balancers.
- Build and package infrastructure (private package registry, CI runners) is hosted separately at Hetzner in Nuremberg, Germany, and holds no customer data.
2. Protective controls (implemented)
- HTTPS-only public endpoints; HTTP is redirected.
- Internal metrics endpoints are blocked at the gateway for external requests.
- IP block lists at the gateway for abusive sources.
- Rate limiting on all APIs (Redis-backed) with stricter limits on login, second-factor, verification and PIN endpoints; account lockout after repeated failures.
- Security headers on API responses (including HSTS).
- Inbound webhooks are accepted only with valid provider signatures.
3. Monitoring and detection (implemented)
- Prometheus with Alertmanager collects metrics from the cluster and services; alerts are delivered to the operations team in real time via a messaging channel.
- Dashboards for service health and resource usage.
- Kubernetes health and readiness probes restart unhealthy services automatically.
- Runtime errors of every service are recorded automatically as tracked bug tasks.
- Authentication events and API actions are logged centrally.
- A public status page reports component status and incidents.
4. Planned improvements
- Kubernetes network policies (default-deny between namespaces and workloads).
- Strict mutual TLS inside the service mesh with authorisation policies (internal traffic is not yet mutually authenticated).
- Evaluation of a web application firewall in front of the ingress gateway.