Skip to content

Latest commit

 

History

History
181 lines (149 loc) · 8.16 KB

Onboarding.md

File metadata and controls

181 lines (149 loc) · 8.16 KB
Raw

Infrastructure and application setup for new clients

Welcome to the process of setting up your infrastructure and your application!

Page HTML load time

Details about infrastructure and source code management

Specialized infrastructure providers

Choose one per category.

  1. Domain registrar: AWS, Gandi 🇪🇺, Cloudflare, noip, dyn, Rackhost/.hu 🇪🇺
  2. DNS provider: AWS, HE, Google, Cloudflare, Exoscale 🇪🇺, Gandi 🇪🇺
  3. Server provider: UpCloud 🇪🇺
  4. SSL certificate provider for HTTPS: Cheapsslsecurity.com, SSLMate, DigiCert, Certum 🇪🇺, Buypass 🇪🇺
  5. CDN provider: AWS, KeyCDN 🇪🇺
  6. Transactional email provider: AWS, SparkPost, SparkPost EU 🇪🇺
  7. Storage provider: AWS, Backblaze B2, Selectel, Oktawave 🇪🇺

.hu domain regisztrátorok

Google Cloud Platform Premium Support for $100/mo

AWS Europe invoicing

AWS certificates for internal usage only

Secure browser in an ephemeral cloud instance

  • Deploy Windows Server 2016 Standard instance
  • Finish installation on the console: set language
  • Log in as Administrator with RDP on Windows or RDP on Mac
  • Download Basilisk browser
  • Create UpCloud shortcut on the Desktop: basilisk.exe "https://www.upcloud.com/register/?promo=U29Q8S"
  • Create AWS shortcut: "https://portal.aws.amazon.com/gp/aws/developer/registration/index.html"
  • Download user.js to %APPDATA%\Moonchild Productions\Basilisk\Profiles\
  • Open On-Screen Keyboard for entering passwords
  • Use the browser
  • Delete the instance

Notify on account breach

  1. Search email address https://haveibeenpwned.com/
  2. Search password https://haveibeenpwned.com/Passwords

UpCloud registration

  • Referral URL
  • KeePass is an open source password manager
  • Enable 2FA (Google Authenticator)
  • Use a virtual bank card with a sub account
  • My Account / Billing / MANUAL
  • My Account / Billing / AUTOMATED / Credit Card drop-down
  • Servers / Deploy a server
  • Check IP reputation (Security Trails, Project Honey Pot, HE BGP Toolkit, AbuseIPDB)
  • Servers / Server listing / (server name) / IP ADDRESSES / REVERSE DNS NAME Public IPv4 + IPv6
  • Log out (prevent session hijacking)
  • Document server IP + password

Amazon Web Services registration

  • https://aws.amazon.com/
  • KeePass is an open source password manager
  • Account type: Professional
  • Use a virtual bank card with a sub account
  • Verification phone call: dial numbers
  • Support Plan: Basic
  • Enable 2FA (Google Authenticator)
  • Billing / Disable Free Tier Usage Alerts
  • CloudWatch / Create Alarm for EstimatedCharges
  • Route53 / Domain + DNS
  • CloudFront / CDN
  • SES / Domain + SMTP credentials + Move Out of the Sandbox + Bounce notification
  • S3 / Server backup bucket
  • IAM / Route53 API user + CloudFront API user + S3 API user
  • Log out (prevent session hijacking)
  • Document credentials

Infrastructure setup

  • Document in hosting.yml and server.yml (Skype, Google Contacts, KeePass, link-torzs)
  • Gain access to providers (web based sub-account or API)
  • Manage migrations (WeTransfer.com)
  • PTR/IPv4, PTR/IPv6 records
  • Domain locking and autorenew
  • DNS records (check, clean up, monitor)
  • Incoming ESP and bounce notification
  • Whitelisted IP-s (office)

Application setup

  • 3rd parties (document, gain access, set up)
  • User names and SSH keys
  • Git repository, branch usage (git flow)
  • Issue tracker
  • Paid plugins, libraries (updates, gain access, support)
  • Application environment definition
  • Set up CI
  • Write deploy script
  • Notifications (email, chat, SMS)
  • Revenue tracking
  • Error tracking
  • Development: development in production?, who has access, where to develop, how to deploy
  • Editorial duties: who has time and competence

Email delivery

Backup

  • Data on servers is automatically backed up daily with 7 days rotation
  • External resources (S3 bucket)
  • Email accounts (local, IMAP)
  • Issues (Trello, GitLab)
  • Code repositories (GitLab, GitHub)

Cyber security

  • All participants should stop using their browsers to store form data and passwords
  • Spam filtering
  • Protection against malware and phishing attacks (credential stealing)
  • Against key loggers
  • Against mobile malware
  • Ransomware mitigation
  • Data breach prevention (in the application)
  • Incident response plan (outage, security incident)

Collaboration

  • No emails if it is possible
  • Issues/ticketing: Trello cards
  • Chat: Slack

Onboarding for developers

  • We run Debian GNU/Linux on an UpCloud cloud instance
  • MariaDB or Percona Server + Apache with HTTP/2 and event MPM + PHP-FPM 7 + Redis (full feature list)
  • Every web application (and website) runs as a separate Linux user
  • There are no passwords for Linux users, only SSH keys
  • All non-production servers are accessible through SSH: terminal, MySQL tunnel, file upload, code deploy etc.
  • Production servers are not accessible for humans (except through HTTPS)
  • TCP ports for web and SSH are heavily protected (maxretry=3) with Fail2ban
  • Source code is kept in git (version-control system)
  • PHP OPcache's file timestamp validation is off, thus PHP files are read once at first access, we use cachetool to reset OPcache after code change
  • There are standard directories for sessions, upload and tmp
  • .htaccess files are disabled, Apache rules should be in vhost configuration (it is faster)
  • File versioning is not in query string but turned into file names like filename.002.ext in URL-s, an Apache rule reverts them
  • Your web application is protected by a WAF
  • Blacklisted things: FTP/S protocol, web-based administration tools (cPanel, phpMyAdmin), POP3/S protocol
  • How to design and implement CI and CD
  • Running a Laravel application
  • Installing WordPress
  • Interesting read on web applications