> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ultrabalancer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Best Security Practices

> Secure your UltraBalancer deployment with TLS, authentication, rate limiting, and hardening

## Overview

Comprehensive security guide for protecting your UltraBalancer deployment in production environments.

<CardGroup cols={2}>
  <Card title="TLS/SSL" icon="lock">
    HTTPS and certificate management
  </Card>

  <Card title="Access Control" icon="user-shield">
    Authentication and authorization
  </Card>

  <Card title="Rate Limiting" icon="gauge-simple-high">
    DDoS protection
  </Card>

  <Card title="Hardening" icon="shield-check">
    System security hardening
  </Card>
</CardGroup>

## TLS Termination

<Note>
  UltraBalancer currently does not have built-in TLS support. Use a reverse proxy like Nginx or Caddy for TLS termination.
</Note>

### TLS with Nginx

Place Nginx in front of UltraBalancer for HTTPS:

```nginx nginx.conf theme={null}
upstream ultrabalancer {
    server 127.0.0.1:8080;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/server.crt;
    ssl_certificate_key /etc/ssl/private/server.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://ultrabalancer;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
```

### TLS with Caddy

Caddy provides automatic HTTPS:

```caddyfile Caddyfile theme={null}
example.com {
    reverse_proxy localhost:8080
}
```

Caddy automatically obtains and renews Let's Encrypt certificates.

## Firewall Configuration

### UFW (Ubuntu)

```bash theme={null}
# Allow HTTPS only
sudo ufw allow 443/tcp

# Restrict metrics endpoint to monitoring subnet
sudo ufw allow from 10.0.0.0/8 to any port 8080

# Enable firewall
sudo ufw enable
```

### iptables

```bash theme={null}
# Allow HTTPS
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Restrict metrics
sudo iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 8080 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8080 -j DROP

# Save rules
sudo iptables-save > /etc/iptables/rules.v4
```

## Security Hardening

### Run as Non-Root User

```bash theme={null}
# Create dedicated user
sudo useradd -r -s /bin/false ultrabalancer

# Set ownership
sudo chown -R ultrabalancer:ultrabalancer /etc/ultrabalancer
sudo chown -R ultrabalancer:ultrabalancer /var/log/ultrabalancer

# Run as user
sudo -u ultrabalancer ultrabalancer -c /etc/ultrabalancer/config.yaml
```

### File Permissions

```bash theme={null}
# Restrict config file
sudo chmod 600 /etc/ultrabalancer/config.yaml
sudo chown root:ultrabalancer /etc/ultrabalancer/config.yaml

# Restrict TLS private key
sudo chmod 600 /etc/ssl/private/server.key
sudo chown root:root /etc/ssl/private/server.key
```

## Best Practices

<Tip>
  **Security Checklist**

  * ✓ Use Nginx/Caddy for TLS termination
  * ✓ Restrict metrics endpoints with firewall
  * ✓ Run as non-root user
  * ✓ Enable firewall rules
  * ✓ Regular security updates
  * ✓ Monitor access logs
  * ✓ Configure rate limiting if needed
  * ✓ Secure file permissions
</Tip>

## Related Topics

<CardGroup cols={2}>
  <Card title="Configuration" icon="sliders" href="/configuration/overview">
    Security configuration options
  </Card>

  <Card title="Deployment" icon="rocket" href="/deployment/linux-server">
    Secure deployment
  </Card>

  <Card title="Monitoring" icon="chart-line" href="/integration/monitoring">
    Security monitoring
  </Card>

  <Card title="Troubleshooting" icon="wrench" href="/advanced/troubleshooting">
    Debug security issues
  </Card>
</CardGroup>