# secureconfig.ai

> TLS, strong authentication, and MFA setup guides for AI development assistants. Start with the README for the decision guide, the full index, and the verification checklist, then fetch the guide matching the stack. Every guide concatenated into one file: https://secureconfig.ai/llms-full.txt . The content of this site and of the secureconfig project is dedicated to the public domain under CC0 1.0, except the AIQT Guardrails material listed in .aiqt/PIN, which is licensed under the Apache License 2.0. Jeff Posluns' other projects carry their own licensing terms.

## Start here

<!-- One entry: the orientation document. Every guide lives in exactly one
     category below, matching README.md's guide index, which tools/run_all_checks.sh
     enforces. Listing a guide here as well would hand a reader the same file twice. -->

- [README](https://raw.githubusercontent.com/jposluns/secureconfig/main/README.md): baseline rules for AI assistants, decision guide, index, verification checklist
- [controls-reference](https://raw.githubusercontent.com/jposluns/secureconfig/main/controls-reference.md): generic control patterns to assess an application that has no guide of its own

## Certificates and tunnels

- [free-certificates](https://raw.githubusercontent.com/jposluns/secureconfig/main/free-certificates.md): free publicly trusted certificates via ACME (Let's Encrypt, ZeroSSL), automated renewal
- [self-signed](https://raw.githubusercontent.com/jposluns/secureconfig/main/self-signed.md): OpenSSL and mkcert certificates, distributing trust to clients
- [cloudflare](https://raw.githubusercontent.com/jposluns/secureconfig/main/cloudflare.md): Cloudflare Tunnel and Zero Trust Access, no open inbound ports
- [tailscale](https://raw.githubusercontent.com/jposluns/secureconfig/main/tailscale.md): tailscale serve (tailnet-only) and funnel (public), automatic TLS
- [tunnels](https://raw.githubusercontent.com/jposluns/secureconfig/main/tunnels.md): frp, WireGuard, and ssh -R, self-hosted tunnels when there is no public IP

## Identity, authentication, and secrets

- [authentication](https://raw.githubusercontent.com/jposluns/secureconfig/main/authentication.md): password storage, sessions, API keys, rate limiting
- [identity-providers](https://raw.githubusercontent.com/jposluns/secureconfig/main/identity-providers.md): hosted identity and MFA: Entra ID, Google, Okta, Auth0, Cognito, Clerk, WorkOS, Supabase Auth, Duo; free tiers and who each fits
- [self-hosted-idp](https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-idp.md): Self-hosted Keycloak and authentik: separating the admin surface at the proxy, the first-boot admin window, and the management port
- [oidc-integration](https://raw.githubusercontent.com/jposluns/secureconfig/main/oidc-integration.md): OIDC login wiring for Google, Microsoft Entra, GitHub, and Okta: PKCE, redirect URIs, token validation, allowlist check
- [cloud-identity-proxies](https://raw.githubusercontent.com/jposluns/secureconfig/main/cloud-identity-proxies.md): login in front of the app with no code change: AWS ALB, Google IAP, Azure App Service, Cloudflare Access, ngrok, Vercel
- [fronting-auth](https://raw.githubusercontent.com/jposluns/secureconfig/main/fronting-auth.md): oauth2-proxy, Authelia, Pomerium: login and MFA in front of an app that has none
- [mfa](https://raw.githubusercontent.com/jposluns/secureconfig/main/mfa.md): MFA options: identity layers with QR-code TOTP enrolment, app libraries, SSH modules, Duo
- [machine-auth](https://raw.githubusercontent.com/jposluns/secureconfig/main/machine-auth.md): machine identity: API keys, client credentials, mutual TLS, workload identity federation, secret managers
- [secrets](https://raw.githubusercontent.com/jposluns/secureconfig/main/secrets.md): keeping keys out of repositories, scanning, rotation after a leak
- [vault](https://raw.githubusercontent.com/jposluns/secureconfig/main/vault.md): HashiCorp Vault: seal custody, listener TLS, audit devices, root-token retirement, path-scoped ACL policies, bounded AppRole credentials and tokens, response-wrapped secret delivery, and authenticated metrics/profiling

## Web servers and proxies

- [apache](https://raw.githubusercontent.com/jposluns/secureconfig/main/apache.md): Apache HTTP Server: TLS, redirect, HSTS, basic auth, client certificates
- [nginx](https://raw.githubusercontent.com/jposluns/secureconfig/main/nginx.md): nginx: TLS, redirect, HSTS, basic auth, client certificates, reverse proxy
- [lighttpd](https://raw.githubusercontent.com/jposluns/secureconfig/main/lighttpd.md): lighttpd: TLS via mod_openssl, redirect, basic auth
- [caddy](https://raw.githubusercontent.com/jposluns/secureconfig/main/caddy.md): Caddy: automatic HTTPS, internal CA, basic auth
- [haproxy](https://raw.githubusercontent.com/jposluns/secureconfig/main/haproxy.md): HAProxy: TLS termination, redirect, HSTS, basic auth
- [traefik](https://raw.githubusercontent.com/jposluns/secureconfig/main/traefik.md): Traefik: ACME resolvers, HTTPS redirection, basic auth middleware

## Languages and frameworks

- [nodejs](https://raw.githubusercontent.com/jposluns/secureconfig/main/nodejs.md): Node.js and Express
- [python](https://raw.githubusercontent.com/jposluns/secureconfig/main/python.md): Flask, FastAPI/Uvicorn, Gunicorn, Django
- [nextjs](https://raw.githubusercontent.com/jposluns/secureconfig/main/nextjs.md): Next.js: sessions, Route Handlers, Server Actions, Auth.js and Better Auth, Vercel
- [go](https://raw.githubusercontent.com/jposluns/secureconfig/main/go.md): Go net/http: TLS, proxy layout, bcrypt, cookies
- [dotnet](https://raw.githubusercontent.com/jposluns/secureconfig/main/dotnet.md): ASP.NET Core and Kestrel: HTTPS, HSTS, forwarded headers, Identity
- [java](https://raw.githubusercontent.com/jposluns/secureconfig/main/java.md): Spring Boot: server.ssl, forwarded headers, Spring Security
- [php](https://raw.githubusercontent.com/jposluns/secureconfig/main/php.md): PHP and Laravel: password_hash, session cookies, trusted proxies, forced HTTPS
- [ruby](https://raw.githubusercontent.com/jposluns/secureconfig/main/ruby.md): Rails and Puma: force_ssl, trusted proxies, has_secure_password, credentials
- [frontend-frameworks](https://raw.githubusercontent.com/jposluns/secureconfig/main/frontend-frameworks.md): SvelteKit, Nuxt, Vite: server-route auth, sessions, public-env prefixes

## Containers and Kubernetes

- [docker](https://raw.githubusercontent.com/jposluns/secureconfig/main/docker.md): safe port publishing, the UFW bypass problem
- [kubernetes](https://raw.githubusercontent.com/jposluns/secureconfig/main/kubernetes.md): Gateway API, cert-manager, entry-point auth; ingress-nginx retired
- [gitops-controllers](https://raw.githubusercontent.com/jposluns/secureconfig/main/gitops-controllers.md): Argo CD and Flux: cluster-admin-equivalent deployment engines; the initial admin secret, RBAC, and the Flux webhook receiver
- [self-hosted-ci-runners](https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-ci-runners.md): GitHub Actions runner and GitLab Runner: untrusted code is RCE; ephemeral one-job workers, no privileged executor, tokens are credentials
- [container-hardening](https://raw.githubusercontent.com/jposluns/secureconfig/main/container-hardening.md): non-root, dropped capabilities, read-only root, network segmentation

## Hosts and cloud platforms

- [host](https://raw.githubusercontent.com/jposluns/secureconfig/main/host.md): SSH hardening, firewall baseline, updates
- [cloud-firewalls](https://raw.githubusercontent.com/jposluns/secureconfig/main/cloud-firewalls.md): security groups and network rules
- [paas](https://raw.githubusercontent.com/jposluns/secureconfig/main/paas.md): Render, Fly.io, Vercel, and similar: what stays yours
- [gpu-clouds](https://raw.githubusercontent.com/jposluns/secureconfig/main/gpu-clouds.md): RunPod, Vast.ai, Lambda, Modal: exposed ports and differing firewall and auth defaults per platform

## Databases, storage, and messaging

- [postgresql](https://raw.githubusercontent.com/jposluns/secureconfig/main/postgresql.md): PostgreSQL: server TLS, SCRAM authentication, pg_hba rules, verified client connections, runtime-vs-owner privilege separation, restricted CONNECT and schema CREATE, secure search_path, and connection/DDL audit logging
- [connection-poolers](https://raw.githubusercontent.com/jposluns/secureconfig/main/connection-poolers.md): PgBouncer and pgpool-II: client TLS that is off by default, a server hop that falls back to plaintext, and the pg_hba rules a pooler stops matching
- [mysql](https://raw.githubusercontent.com/jposluns/secureconfig/main/mysql.md): MySQL and MariaDB: required TLS transport, per-user TLS, modern auth plugins, scoped least-privilege accounts, anonymous/test/remote-root cleanup, local_infile and secure_file_priv restrictions, and password validation/reuse
- [mongodb](https://raw.githubusercontent.com/jposluns/secureconfig/main/mongodb.md): MongoDB: requireTLS, authorization, bind address, least-privilege roles with explicit SCRAM-SHA-256, replica/cluster membership auth, per-user source restrictions, and x.509 client identities
- [redis](https://raw.githubusercontent.com/jposluns/secureconfig/main/redis.md): Redis: TLS, requirepass, bind/protected-mode, and least-privilege ACLs with durable rules, key/channel scoping, and runtime command lockdown
- [sqlite](https://raw.githubusercontent.com/jposluns/secureconfig/main/sqlite.md): SQLite in deployment, the file is the exposure; Turso tokens; Litestream
- [sqlite-http-frontends](https://raw.githubusercontent.com/jposluns/secureconfig/main/sqlite-http-frontends.md): Datasette and sqlite-web: SQLite HTTP exposure, loopback binding, authentication, TLS, and verification
- [surrealdb](https://raw.githubusercontent.com/jposluns/secureconfig/main/surrealdb.md): SurrealDB, root credentials, bind address, access levels, TLS
- [time-series-metrics-stores](https://raw.githubusercontent.com/jposluns/secureconfig/main/time-series-metrics-stores.md): InfluxDB, VictoriaMetrics, and QuestDB auth defaults and fronting
- [elasticsearch](https://raw.githubusercontent.com/jposluns/secureconfig/main/elasticsearch.md): Elasticsearch and OpenSearch: keep built-in security on, scoped roles and API keys, anonymous/CORS lockdown, audit logging
- [clickhouse](https://raw.githubusercontent.com/jposluns/secureconfig/main/clickhouse.md): user passwords, secure ports, network restrictions, SQL-driven RBAC with table-scoped roles, query/memory limits and quotas, external-source restrictions, and protected query/session logs
- [neo4j](https://raw.githubusercontent.com/jposluns/secureconfig/main/neo4j.md): initial password, Bolt and HTTPS TLS, auth stays on, scoped Enterprise roles with label/property grants, procedure/function/load denials, transaction memory and timeout limits, and security-event logging
- [memcached](https://raw.githubusercontent.com/jposluns/secureconfig/main/memcached.md): no auth by default; private binding and UDP off, dedicated unprivileged account, connection and item-memory limits, disabled cache-wide flush and key enumeration, SASL and TLS where built in
- [search-engines](https://raw.githubusercontent.com/jposluns/secureconfig/main/search-engines.md): Meilisearch and Typesense, master key, scoped search keys, production mode
- [minio](https://raw.githubusercontent.com/jposluns/secureconfig/main/minio.md): MinIO (AIStor): root and scoped credentials, TLS, server-side encryption, object locking, and audit logging
- [object-storage](https://raw.githubusercontent.com/jposluns/secureconfig/main/object-storage.md): S3, R2, GCS, Azure Blob, Supabase Storage: private by default, scoped credentials, signed URLs
- [firebase-supabase](https://raw.githubusercontent.com/jposluns/secureconfig/main/firebase-supabase.md): security rules and row-level security, ownership across Firestore/RTDB/Storage, Data-API and key hygiene, function/Storage/Realtime authorization, App Check, and signup controls
- [supabase-self-hosted](https://raw.githubusercontent.com/jposluns/secureconfig/main/supabase-self-hosted.md): the self-hosted Docker stack ships demo keys and a default dashboard password; an unedited compose up publishes the database
- [pocketbase](https://raw.githubusercontent.com/jposluns/secureconfig/main/pocketbase.md): PocketBase and Appwrite: API and collection rules are the security, plus auth-record and file-field protection, operator and console lockdown, settings encryption, rate limits, and hostname and upload controls
- [headless-cms-instant-api](https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-cms-instant-api.md): Strapi, Directus, Hasura, and PostgREST: one control gates the whole datastore
- [rabbitmq](https://raw.githubusercontent.com/jposluns/secureconfig/main/rabbitmq.md): RabbitMQ: users and permissions, TLS listener, guest account, vhost isolation and resource limits, management HTTPS, monitoring/admin role separation, concrete private bindings, and safe definitions import
- [mosquitto](https://raw.githubusercontent.com/jposluns/secureconfig/main/mosquitto.md): MQTT: per-device credentials, TLS and mutual TLS, topic ACLs with $SYS isolation, connection/packet/queue limits, per-listener scoping, bridge security, and runtime hardening
- [kafka](https://raw.githubusercontent.com/jposluns/secureconfig/main/kafka.md): SASL_SSL listeners, SCRAM credentials, ACLs, client/replication/controller listener separation, per-role least-privilege ACLs, user quotas and connection limits, and authorization audit logging
- [nats](https://raw.githubusercontent.com/jposluns/secureconfig/main/nats.md): NATS and JetStream, auth, TLS, and the unauthenticated monitoring port

## AI and agent infrastructure

- [ollama](https://raw.githubusercontent.com/jposluns/secureconfig/main/ollama.md): no built-in auth or TLS; protect with a proxy or tunnel
- [model-servers](https://raw.githubusercontent.com/jposluns/secureconfig/main/model-servers.md): llama.cpp, vLLM, TGI, SGLang, Triton, LM Studio
- [litellm](https://raw.githubusercontent.com/jposluns/secureconfig/main/litellm.md): master key and virtual keys, per-key spend and rate limits, model-access allowlists, key expiry and revocation, admin/route separation, egress and pass-through limits, and request-content log redaction
- [vector-databases](https://raw.githubusercontent.com/jposluns/secureconfig/main/vector-databases.md): Qdrant, Weaviate, Milvus, Chroma, pgvector: API keys, TLS, what has no native auth
- [mcp-servers](https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-servers.md): stdio versus Streamable HTTP, loopback, Origin checks, OAuth 2.1 or a fronting layer
- [mcp-clients](https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-clients.md): MCP client authorization: iss validation and mix-up defence, metadata issuer identity, Client ID Metadata Documents, refresh-token confidentiality, OAuth-discovery SSRF
- [ray](https://raw.githubusercontent.com/jposluns/secureconfig/main/ray.md): dashboard, Jobs, and Client ports execute code; isolate, token auth, SSH forward
- [mlflow](https://raw.githubusercontent.com/jposluns/secureconfig/main/mlflow.md): no auth by default; basic-auth app, TLS in front
- [llm-observability](https://raw.githubusercontent.com/jposluns/secureconfig/main/llm-observability.md): Langfuse, Phoenix, Helicone, OpenTelemetry Collector: they hold prompts and keys
- [agent-builders](https://raw.githubusercontent.com/jposluns/secureconfig/main/agent-builders.md): Dify, Flowise, Langflow, LibreChat: admin setup, API keys, fronting TLS
- [ai-infra-services](https://raw.githubusercontent.com/jposluns/secureconfig/main/ai-infra-services.md): SearxNG, LocalAI, Text Embeddings Inference, LangServe, Mem0, Onyx: what the run form publishes, and the store published beside the front door
- [workflow-orchestrators](https://raw.githubusercontent.com/jposluns/secureconfig/main/workflow-orchestrators.md): Prefect, Dagster, Airflow, Temporal, Flower, Argo: keep off the public internet and require auth
- [headless-browser-services](https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-browser-services.md): Chrome DevTools Protocol, Selenium Grid, browserless, Playwright: an exposed browser port is remote code execution
- [realtime-voice-infra](https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-voice-infra.md): LiveKit and coturn: WebRTC SFU signing keys and the TURN open-relay default, RFC 1918 relay policy, TLS

## App UIs and dev tools

- [open-webui](https://raw.githubusercontent.com/jposluns/secureconfig/main/open-webui.md): signup control and fronting TLS, persistent signing key, trusted-proxy and OAuth boundaries, tool and code-execution limits, model and admin-data access control, API-key restrictions, and retrieval/SSRF limits
- [chat-uis](https://raw.githubusercontent.com/jposluns/secureconfig/main/chat-uis.md): AnythingLLM, LobeChat, Chainlit, OpenHands: open by default; front with login
- [image-gen-uis](https://raw.githubusercontent.com/jposluns/secureconfig/main/image-gen-uis.md): ComfyUI, A1111, InvokeAI, Fooocus: keep on loopback and add a login before exposing
- [gradio](https://raw.githubusercontent.com/jposluns/secureconfig/main/gradio.md): Gradio: launch() auth and TLS, share-link risks, file-access and cache isolation, optional-execution-surface and API-visibility controls, queue and resource limits, URL-fetch SSRF limits, external auth, and flagging/telemetry controls
- [streamlit](https://raw.githubusercontent.com/jposluns/secureconfig/main/streamlit.md): Streamlit: TLS options, native OIDC login, reverse proxy deployment
- [jupyter](https://raw.githubusercontent.com/jposluns/secureconfig/main/jupyter.md): Jupyter Server, Lab, and Notebook: hashed password and TLS, unprivileged execution, origin/XSRF/DNS-rebinding protection, JupyterHub identities and per-user isolation, and auth by default
- [n8n](https://raw.githubusercontent.com/jposluns/secureconfig/main/n8n.md): n8n: listen address, native TLS, owner setup, MFA enforcement
- [code-server](https://raw.githubusercontent.com/jposluns/secureconfig/main/code-server.md): code-server: SSH forwarding first, password auth, TLS
- [self-hosted-error-trackers](https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-error-trackers.md): Sentry and GlitchTip registration defaults and reverse-proxy TLS

## Dashboards and admin consoles

- [admin-uis](https://raw.githubusercontent.com/jposluns/secureconfig/main/admin-uis.md): phpMyAdmin, pgAdmin, mongo-express, Grafana, Prometheus
- [observability-components](https://raw.githubusercontent.com/jposluns/secureconfig/main/observability-components.md): node_exporter, Alertmanager, Pushgateway, Jaeger, Loki: unauthenticated by default; never public
- [devops-uis](https://raw.githubusercontent.com/jposluns/secureconfig/main/devops-uis.md): Portainer, Coolify, Dokploy, Nginx Proxy Manager, Vaultwarden, Kubernetes Dashboard, Jenkins, Gitea, Uptime Kuma, Docker API: never public
- [bi-dashboards](https://raw.githubusercontent.com/jposluns/secureconfig/main/bi-dashboards.md): Metabase, Superset, Redash: never public; least-privilege database user
- [low-code-builders](https://raw.githubusercontent.com/jposluns/secureconfig/main/low-code-builders.md): NocoDB, Baserow, Appsmith, Budibase, Windmill: first-run admin, open signup, sample secrets
- [server-admin-panels](https://raw.githubusercontent.com/jposluns/secureconfig/main/server-admin-panels.md): Cockpit, Webmin, Proxmox VE: root-level host panels on every address, no default second factor
- [nomad-consul](https://raw.githubusercontent.com/jposluns/secureconfig/main/nomad-consul.md): Nomad, Consul: APIs with ACLs off by default, anonymous bootstrap, Consul's allow default

## Web application controls

- [cors](https://raw.githubusercontent.com/jposluns/secureconfig/main/cors.md): allow your origins, not everyone's
- [headers](https://raw.githubusercontent.com/jposluns/secureconfig/main/headers.md): HSTS, CSP, and companions
- [realtime-webhooks](https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-webhooks.md): WebSocket, SSE, and webhook authentication
- [transactional-email-posture](https://raw.githubusercontent.com/jposluns/secureconfig/main/transactional-email-posture.md): SPF, DKIM, DMARC, and SMTP submission posture

## Exposure and deployment operations

- [web-exposure](https://raw.githubusercontent.com/jposluns/secureconfig/main/web-exposure.md): files a web server must never serve: dotfiles, .git, dumps, client secrets
- [egress-metadata](https://raw.githubusercontent.com/jposluns/secureconfig/main/egress-metadata.md): egress control and cloud metadata (IMDSv2), stop an agent exfiltrating credentials
- [deployment-lifecycle](https://raw.githubusercontent.com/jposluns/secureconfig/main/deployment-lifecycle.md): verify from outside, safe first-run order, previews, and teardown
- [exposure-index](https://raw.githubusercontent.com/jposluns/secureconfig/main/exposure-index.md): narrow an open port to the guides worth reading; a port never identifies a service
- [common-mistakes](https://raw.githubusercontent.com/jposluns/secureconfig/main/common-mistakes.md): the recurring findings, each linked to its fix

## Optional

- [Repository](https://github.com/jposluns/secureconfig): source for all guides and this site
- [Contributing](https://raw.githubusercontent.com/jposluns/secureconfig/main/CONTRIBUTING.md): scope and the bar for new guides