Server security

What the installation already does

• Key-only SSH, root login closed (after the deploy login is verified), at most 3 attempts per connection.
• Firewall allows only SSH, 80 and 443. The database and API are not reachable from the internet because Docker does not publish their ports.
• fail2ban bans SSH password guessing.
• Automatic security updates of the OS.
• Secrets only in .env on the server (mode 600), never in Docker images or git. Keys entered in the admin panel are stored encrypted.
• Application database role cannot change or delete the action log and money ledger — even a website compromise cannot rewrite history.
• Backups are encrypted and taken every hour.

Admin panel by IP

The admin panel works only on the admin. subdomain and lets in two kinds of addresses:

1. ADMIN_ALLOWED_IPS in .env — the owner's emergency access. Always works, even if the API is down. Changed on the server, then docker compose up -d caddy.
2. Staff addresses from Settings → Staff — added in the admin panel and work immediately, no server change.

Everyone else is refused before the login page. A hidden path like /admin55 is not protection — the closed subdomain is.

Before going live

If you opened the admin panel widely during setup (e.g. 0.0.0.0/0), put back only your own addresses or your VPN subnet in ADMIN_ALLOWED_IPS.

Staff sign-in

• Password + authenticator app code (2FA) — mandatory for all staff.
• After 5 wrong passwords sign-in is blocked and the guessing address is banned automatically.
• Sessions are in Settings → Staff → Sessions: IP, browser, last activity. Any session can be ended.

Routine

How often	What
Daily	System status and error notifications
Weekly	Staff sessions, bans, action log for anything odd
Monthly	Verify a copy on a temporary database; df -h
When someone leaves	Disable them in “Staff” — their sessions end and their IP stops working

Don't

• Don't add ports: to the db and api services in docker-compose.yml: Docker publishes ports bypassing the firewall (ufw), and the database would be on the internet.
• Don't change firewall rules without need.
• Don't give staff SSH access — all work is in the admin panel.
• Don't keep .env and copies with the backup password in one place.
• Don't enable SSH password login.
• Don't host other websites or control panels on the same server.

If you suspect a breach

1. Keep only your own address in ADMIN_ALLOWED_IPS.
2. In “Staff” review the list: disable unknown and unneeded people, remove foreign IPs from staff and roles — the admin gate lets them in too.
3. End all sessions and change staff passwords and 2FA.
4. Rotate SESSION_SECRET and ADMIN_GATE_SECRET in .env (openssl rand -hex 32) and run docker compose up -d api worker caddy — all sign-ins become invalid.
5. Reissue keys at payment systems, the AML provider, mail and the Telegram bot token, and enter the new ones.
6. Review the action log — who did what.
7. Take a database copy and contact OneSwaper support.