Skip to content

v1.0.0

Choose a tag to compare

View all tags
@xinitd xinitd released this 11 Oct 13:40
· 28 commits to main since this release
v1.0.0
cf1a3e0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First public release. A hardened reference deployment of FastAPI behind Nginx with Docker Compose, running at https://sclerotin.args.tech

The application is one endpoint, trivial on purpose: the release is everything around it.

What's in place

  • A Content Security Policy per kind of response: default-src 'none' for the API, a policy of its own for the landing page, a relaxed one for the docs only while they are switched on
  • Security headers split between Nginx and the app, error responses included
  • The app on an internal network with no route out of the host
  • Read-only root filesystems, all capabilities dropped, no-new-privileges, memory, CPU and PID limits, an unprivileged app user
  • Unknown host names and bare-IP requests dropped without an answer
  • Per-address rate limits that see real IPv6 addresses, request size limits and timeouts against slow clients
  • TLS 1.2 and 1.3 with Mozilla's intermediate profile, post-quantum hybrid key exchange (X25519MLKEM768) and HSTS; Let's Encrypt with automatic renewal

Pinned in this release

  • Python 3.14.7 (slim), FastAPI 0.142.3, Uvicorn 0.54.0 and the rest of the dependency set in requirements.txt
  • nginx:stable-alpine by SHA256 digest
  • opentelemetry-api is pinned too: FastAPI 0.142 requires it. With no OpenTelemetry SDK in the image it stays inert, and the app has no route out anyway
  • Weekly Dependabot pull requests keep the pins current

Requirements

Docker Engine 27+ and Compose 2.17+, a rootful daemon without userns-remap. Why each of them is needed is in the README.

Check the live headers

curl -sD - https://sclerotin.args.tech/api/v1/ping

Every choice is explained in How it works.

Assets 2
Loading