Hi everyone! I'm looking to set up a simple web application using Flask with a MariaDB backend, and I'm using Docker for deployment. I have a few specific questions about best practices for this kind of setup:
1. For SSL termination, should I use a reverse proxy like Nginx, or is there a better option?
2. I need continuous access to the MariaDB instance without exposing the port to the internet. What's the best way to achieve this? Is using iptables rules to restrict access from specific hosts a good idea?
3. Regarding Adminer, should I keep it running all the time, or just start it up when I need it?
4. Aside from configuring user permissions in MariaDB, is there anything else I should consider?
Thanks in advance for your help!
2 Answers
You might want to consider this approach:
1. Using an Nginx container is definitely a best practice for SSL termination. It just makes everything easier.
2. Docker Network should take care of internal communication between containers. You can access the database using the internal names without needing to fiddle with iptables directly.
3. Same goes for Adminer; keep it off unless you really need it.
4. For MariaDB, you really just need to ensure proper port mapping and set the right user permissions. You should be good to go!
Great questions! Let's tackle them one by one:
1. Instead of Nginx, I recommend using Caddy for SSL termination. It automatically handles HTTPS with Let's Encrypt and is super simple to configure.
2. For MariaDB, definitely don't expose port 3306 to the internet. Instead, consider running a WireGuard container for secure access without opening any ports directly. If that's too complicated, SSH tunneling is a solid alternative.
3. I wouldn't keep Adminer running all the time. You can start it up as needed, or set it up behind basic authentication and restrict access by IP to keep it secure.
4. Make sure to enable binary logging on your MariaDB. It’s a lifesaver for recovery if something goes wrong. Also, use named volumes for data and allocate about 70% of your container's memory to InnoDB's buffer pool.
Also, remember that Docker has its own iptables settings, so be mindful of that when setting up your firewall rules!
Totally agree on the Adminer point. Keeping it secure is crucial! I've seen some instances get hacked so fast.
Thanks for the tips on Caddy! I wasn't sure if it could replace Nginx but sounds like a great choice for simplicity.