Infrastructure Security

Steadybase currently runs on AWS EC2 with plans to migrate to ECS Fargate. This page covers the current infrastructure security posture and the target architecture.

Current Architecture

┌─────────────────────────────────────────┐
│  AWS EC2 (t4g.medium, us-west-2)       │
│  Instance: i-063afb7f24a64376a         │
│  Elastic IP: 34.210.217.25            │
│                                         │
│  ┌──────────────────────────────────┐   │
│  │  Nginx (reverse proxy)          │   │
│  │  - TLS 1.2+ (Let's Encrypt)    │   │
│  │  - Security headers (Helmet)    │   │
│  │  - Path blocking (.git, .env)   │   │
│  └──────────────┬───────────────────┘   │
│                 │                        │
│  ┌──────────────▼───────────────────┐   │
│  │  PM2 (process manager)          │   │
│  │  - Auto-restart on crash        │   │
│  │  - Log rotation                 │   │
│  │  - Cluster mode                 │   │
│  └──────────────┬───────────────────┘   │
│                 │                        │
│  ┌──────────────▼───────────────────┐   │
│  │  Express Server (:3000)         │   │
│  │  - Auth middleware              │   │
│  │  - Rate limiting                │   │
│  │  - CORS                         │   │
│  └──────────────────────────────────┘   │
└─────────────────────────────────────────┘
         │
         ▼ (mTLS)
┌─────────────────────────────────────────┐
│  Temporal Cloud (us-west-2)             │
│  Namespace: quickstart-steadybase       │
└─────────────────────────────────────────┘

What's Hardened

Control	Status	Details
TLS 1.2+	Implemented	nginx with Let's Encrypt, auto-renewal
Security headers	Implemented	Helmet: X-Frame-Options, X-Content-Type-Options, HSTS
Sensitive path blocking	Implemented	nginx blocks `.git`, `.env`, `node_modules`
File permissions	Implemented	600 on `.env` and sensitive config files
Process management	Implemented	PM2 with auto-restart, log rotation
Temporal mTLS	Implemented	Client certificate authentication

Known Gaps

:::warning These gaps are documented transparently and prioritized in our roadmap. :::

Critical

Gap	Risk	Remediation
Port 3000 open externally	Direct API access bypassing nginx proxy	Add iptables rule: `iptables -A INPUT -p tcp --dport 3000 -j DROP` (allow only localhost)
SELinux in permissive mode	Reduced OS-level isolation	Switch to enforcing mode with appropriate policies
No automated backups	Data loss risk	Daily encrypted backups to S3

High Priority

Gap	Risk	Remediation
No firewall rules	Open network surface	Configure iptables/security groups
CloudWatch inactive	No centralized monitoring	Enable CloudWatch agent
No health checks	Silent failures	Add health check endpoints + monitoring

Target Architecture (ECS Fargate)

The planned migration to ECS Fargate improves security through:

Container isolation — Each service runs in its own container
No SSH access — Fargate tasks have no shell access
IAM roles — Fine-grained permissions per service
ALB — Application Load Balancer replaces direct nginx
Secrets Manager — Secrets injected at runtime, not stored on disk
VPC — Private subnets for application containers

See ECS Migration for the full target architecture.

Network Security Recommendations

For immediate hardening of the current EC2 architecture:

Close port 3000 — Restrict to localhost only via iptables
Security groups — Allow only 80, 443 from public; SSH from known IPs only
Enable SELinux — Switch from permissive to enforcing
Configure fail2ban — Protect SSH from brute-force attempts
Enable CloudWatch — Centralized logging and alerting

Infrastructure Security

On this page