Best Security Practices

Overview

Comprehensive security guide for protecting your UltraBalancer deployment in production environments.

TLS/SSL

HTTPS and certificate management

Access Control

Authentication and authorization

Rate Limiting

DDoS protection

Hardening

System security hardening

TLS Termination

UltraBalancer currently does not have built-in TLS support. Use a reverse proxy like Nginx or Caddy for TLS termination.

TLS with Nginx

Place Nginx in front of UltraBalancer for HTTPS:

nginx.conf

upstream ultrabalancer {
    server 127.0.0.1:8080;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/server.crt;
    ssl_certificate_key /etc/ssl/private/server.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://ultrabalancer;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

TLS with Caddy

Caddy provides automatic HTTPS:

Caddyfile

example.com {
    reverse_proxy localhost:8080
}

Caddy automatically obtains and renews Let’s Encrypt certificates.

Firewall Configuration

UFW (Ubuntu)

# Allow HTTPS only
sudo ufw allow 443/tcp

# Restrict metrics endpoint to monitoring subnet
sudo ufw allow from 10.0.0.0/8 to any port 8080

# Enable firewall
sudo ufw enable

iptables

# Allow HTTPS
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Restrict metrics
sudo iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 8080 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8080 -j DROP

# Save rules
sudo iptables-save > /etc/iptables/rules.v4

Security Hardening

Run as Non-Root User

# Create dedicated user
sudo useradd -r -s /bin/false ultrabalancer

# Set ownership
sudo chown -R ultrabalancer:ultrabalancer /etc/ultrabalancer
sudo chown -R ultrabalancer:ultrabalancer /var/log/ultrabalancer

# Run as user
sudo -u ultrabalancer ultrabalancer -c /etc/ultrabalancer/config.yaml

File Permissions

# Restrict config file
sudo chmod 600 /etc/ultrabalancer/config.yaml
sudo chown root:ultrabalancer /etc/ultrabalancer/config.yaml

# Restrict TLS private key
sudo chmod 600 /etc/ssl/private/server.key
sudo chown root:root /etc/ssl/private/server.key

Best Practices

Security Checklist

✓ Use Nginx/Caddy for TLS termination
✓ Restrict metrics endpoints with firewall
✓ Run as non-root user
✓ Enable firewall rules
✓ Regular security updates
✓ Monitor access logs
✓ Configure rate limiting if needed
✓ Secure file permissions

Configuration

Security configuration options

Deployment

Secure deployment

Monitoring

Security monitoring

Troubleshooting

Debug security issues

Getting Started

Concepts

Configuration

Deployment

Testing

Integration

API

Advanced

Overview

TLS/SSL

Access Control

Rate Limiting

Hardening

TLS Termination

TLS with Nginx

TLS with Caddy

Firewall Configuration

UFW (Ubuntu)

iptables

Security Hardening

Run as Non-Root User

File Permissions

Best Practices

Configuration

Deployment

Monitoring

Troubleshooting

​Overview

TLS/SSL

Access Control

Rate Limiting

Hardening

​TLS Termination

​TLS with Nginx

​TLS with Caddy

​Firewall Configuration

​UFW (Ubuntu)

​iptables

​Security Hardening

​Run as Non-Root User

​File Permissions

​Best Practices

​Related Topics

Configuration

Deployment

Monitoring

Troubleshooting

Overview

TLS Termination

TLS with Nginx

TLS with Caddy

Firewall Configuration

UFW (Ubuntu)

iptables

Security Hardening

Run as Non-Root User

File Permissions

Best Practices

Related Topics