Building Infrastructure and Security for Repilay

It is not enough for an app going to production to just work.

Detecting problems on time, ensuring the stability of services, and protecting data security are equally important for the business.

Since last week, I’ve been working on the infrastructure and security side of Repilay. The goal was to detect problems in the server or services as quickly as possible and automate manual tasks.

I did the server configurations with #Ansible, services are running in #Docker containers, and #Nginx manages the traffic as a reverse proxy.

On the CI/CD and AppSec side, security checks have been integrated into the pipeline. SAST analyses are performed with #Semgrep and #njsscan, #TruffleHog checks for leaked secrets and credentials in the repository, and #Trivy scans vulnerabilities in the built Docker images. Thus, security checks are automatically carried out as a part of the deployment process.

For monitoring, #Prometheus and #Grafana are used. #NodeExporter monitors server resources (CPU, RAM, disk, network), #cAdvisor shows the resource usage of containers, #PostgresExporter monitors PostgreSQL, and #BlackboxExporter checks whether the services are currently up and running.

Tracking logs separately was time-consuming. Because of this, I set up #Loki and #Alloy and centralized all logs in #Grafana.

On the security side, a private #VPN was set up with #WireGuard. Access from the internet to internal panels like #Grafana is now restricted, and access is only possible via the VPN. #dnsmasq provides its own #DNS within the VPN, meaning it is possible to access them with a domain name instead of an IP address.

The pentest phase of the project has also been conducted, and discovered vulnerabilities have been resolved. On the server side, additional security checks were performed with Lynis and other tools.

Setting all these up in a real production environment was an interesting experience on the #DevSecOps and #AppSec side.

There is still a lot of work to do in Repilay. We continue step-by-step together with our team. 🥶

To support us, you can follow the Repilay LinkedIn account.

#Repilay #DevSecOps #AppSec #Pentest #Ansible #Docker #Grafana #Prometheus #Loki #CyberSecurity