Skip to main content
tavrn Docs

Security hardening checklist

Go through this list before the node opens to the public, and again after larger changes.

  • ☐ TLS at the reverse proxy with HSTS; HTTP redirects to HTTPS; the node’s port 8080 is published on 127.0.0.1 (or only on the proxy’s Docker network), never on a public interface.
  • ☐ TAVRN_TRUSTED_PROXIES lists only your proxies (and, with several instances, the instances’ network).
  • ☐ LiveKit’s port 7880 is not published; /rtc goes only to tavrn; the TURN/TLS backend port is published on 127.0.0.1 only.
  • ☐ Only the media ports (UDP range, TCP 7881, optional UDP 3478) are open besides 80/443.
  • ☐ /metrics is off, or protected by TAVRN_METRICS_TOKEN and blocked at the proxy for the public.
  • ☐ POSTGRES_PASSWORD and VALKEY_PASSWORD are long and random; PostgreSQL and Valkey are reachable only from the node’s network (no host ports).
  • ☐ Secrets in files where possible (TAVRN_OIDC_CLIENT_SECRET_FILE); .env readable only by the operator.
  • ☐ ./data/keys stays mode 0600, owned by the container user; it is backed up, encrypted, and the restore has been tested.
  • ☐ TAVRN_STORAGE_ENCRYPTION=on (the default).
  • ☐ Registration fits your community: invite or closed unless you want open sign-ups; with open, a captcha (TAVRN_CAPTCHA_PROVIDER) and TAVRN_EMAIL=required with SMTP.
  • ☐ Node admins are few; with TAVRN_OIDC_ONLY=true at least one break-glass account in TAVRN_ADMIN_USERS.
  • ☐ TAVRN_UPLOAD_ALLOW_EXECUTABLES=false (the default); TAVRN_UPLOAD_ALLOWED_TYPES as narrow as practical.
  • ☐ SSRF switches stay off unless needed: TAVRN_FEDERATION_ALLOW_PRIVATE, TAVRN_APP_ALLOW_PRIVATE_URLS, TAVRN_FILES_EXTERNAL_PRIVATE.
  • ☐ Never --dev, TAVRN_FEDERATION_DEV_PEERS or TAVRN_DEV_MISBEHAVE in production.
  • ☐ Consider TAVRN_FEDERATION_REQUIRE_CONFORMANCE=true and a TAVRN_FEDERATION_BLOCKLIST; for a closed community TAVRN_FEDERATION_ALLOWLIST or TAVRN_FEDERATION_ENABLED=false.
  • ☐ The container runs as shipped: unprivileged user, read-only root file system, tmpfs on /tmp.
  • ☐ IMAGE_TAG pinned to a release line; releases watched for security fixes; backups before every upgrade.
  • ☐ Logs rotated and treated as personal data; the privacy policy says what the node sees.
  • ☐ Legal contact, imprint and privacy policy published where the law requires them (Legal pages and GDPR).

Report vulnerabilities privately as described in the security policy.

This page is generated from tavrn-node/docs/HANDBOOK.md (AGPL-3.0-only) when the website is built; its links were adapted for this site.