Allowed networks and TLS

The hub publishes one port, TCP 443, and the sites open no inbound port at all. On that port the hub can admit only the networks you list, so the admin UI, the API, sign-in and the site links answer only your offices, your pipelines’ runners and your sites. Every connection is TLS 1.2 or 1.3, with certificates the platform obtains and renews itself.

Limit the hub to your networks#

Allowed networks are a setting, so no file is edited and nothing restarts:

$ weikio settings set --allowed-networks 203.0.113.7/32,198.51.100.0/24

Each entry is a range with its prefix length, and a single address is 203.0.113.7/32 or 2001:db8::7/128. You can also set allowedNetworks in the settings document you keep in Git and apply with weikio apply -f. weikio settings set --no-allowed-networks removes the list, and Settings › Installation shows it. With no list every address reaches the hub, as after install.

The list applies to the admin UI, the API, the weikio CLI, sign-in, the site links and the sites’ telemetry. Every other caller gets 403 Forbidden from the terminator before anything handles its request, except on the sites’ telemetry, which gets 503 Service Unavailable so a site keeps what it sends. Each server applies a change within seconds, and Settings › Health says when a server’s terminator doesn’t.

These stay open on purpose:

• /readyz/node and /healthz on the admin UI’s name accept callers from every address, so the load balancer’s check and your check from outside keep working.
• A certificate authority’s check of a name is served before the list applies, so certificates renew.
• Gateway hostnames aren’t on this list, because each gateway has its own --networks, as Gateways and hostnames describes.

Keep yourself in#

A change that would refuse the address it’s sent from is refused, and the reply gives that address. weikio settings get and the Settings page show the address you reach the hub from. When it’s a private address, such as 10.0.0.5, it may be Docker’s or a load balancer’s rather than your computer’s:

• On a hub on one server, Docker hands every IPv6 caller and every program on the server itself to the hub from one address of the server’s own, 172.16.250.128 by default. A list that has it lets all of them in, so list the IPv4 addresses of your computers and make the change from another computer over IPv4.
• On a hub on several servers, set WEIKIO_BALANCER_ADDRESSES in each server’s .env before you set allowed networks, so the hub sees each caller’s own address through the PROXY protocol.

The reply, weikio apply and Settings › Health warn while the list has the server’s own address.

Sites on the list#

A site links and sends its telemetry from its own address, so that address goes on the list. The hub learns a site’s address from its telemetry, and a change that leaves a known site outside is accepted with the site and its address in the reply, weikio apply and Settings › Health. A site left outside keeps its telemetry on its own disk while it can’t reach the hub, and sends it with its original times once a range has its address.

Behind a CDN the list judges the address the CDN gives for the caller. The CDN’s own ranges go in WEIKIO_EDGE_RANGES and never on the list, as Behind a CDN says.

Locked out#

If the hub refuses your own address, run this on any of its servers, in that server’s stack folder:

$ docker compose run --rm infra weikio-backend networks add <your address>/32 --reason "<why>"

It adds the range to the list with the backend’s own credential, so it needs no sign-in. It prints The hub's allowed networks are now <ranges>. Each server applies them within seconds. networks clear removes the list instead. Both are in the audit trail as AllowedNetworksChanged, with the settings before and after.

TLS on port 443#

The terminator ends TLS for the hub’s own two names, and the gateway for every gateway hostname. Both accept TLS 1.2 and 1.3 only, and on TLS 1.2 only the AEAD suites, AES-GCM and ChaCha20. A client that knows TLS 1.2 only with CBC suites, such as Safari 8 on iOS 8 or OS X 10.10, can’t connect, while current browsers, systems and HTTP libraries can.

No certificate is a file you place: the platform obtains and renews every one, from Let’s Encrypt, your own ACME authority or its own certificate authority, as Certificates describes. The message server’s own ports are never exposed, because every site reaches it over the WebSocket link on 443, and on a hub of several servers the links between the servers are TLS too. weikio-backend doctor checks that the public address answers through the load balancer with TLS 1.2 or later.

The session cookie#

The admin UI is static files inside the backend’s image, served from the same address as the API. Its session cookie keeps the __Host- prefix, there’s no CORS and no cross-site cookie, and the UI and the API always come from one release. The terminator limits sign-in attempts to a burst of 5 and then 10 a minute per caller address, and five wrong answers for one account within 15 minutes lock it for 15 minutes.