Production Hardening

This page provides a checklist and guidance for hardening AEGIS platform deployments for production use.

Pre-Deployment Checklist

TLS Everywhere

External TLS

Deploy the Caddy edge proxy for automatic TLS on all public-facing endpoints. Caddy handles certificate issuance and renewal via ACME.

Internal TLS

For high-security environments, enable TLS on internal pod communication:

• OpenBao: Set tls_disable = false in openbao-config.hcl and provide certificate paths
• PostgreSQL: Enable ssl = on in postgresql.conf with server certificates
• Keycloak: Configure HTTPS on port 8443 with X.509 certificates

Secrets Management

Credential Rotation

Rotate credentials regularly:

Avoiding Plaintext Secrets

• Never commit .env files to version control
• Use env:VAR_NAME or secret:path credential prefixes in aegis-config.yaml
• Store sensitive values in OpenBao and reference them via the secret: prefix

Resource Limits

Configure container resource limits in pod YAML definitions to prevent resource exhaustion:

resources:
  limits:
    memory: "4Gi"
    cpu: "2000m"
  requests:
    memory: "1Gi"
    cpu: "500m"

Recommended minimum limits per pod:

Network Segmentation

Firewall Rules

Only the Caddy edge proxy should be exposed publicly:

Podman Network

All pods run on the aegis-network bridge. Agent containers spawned by the orchestrator also join this network for NFS access to port 2049.

For multi-node deployments, use the cluster protocol (port 50056) with mTLS between nodes. See Multi-Node Deployment.

Access Control

Keycloak Hardening

• Disable the default master realm admin account after creating dedicated admin users
• Enable brute-force detection on all realms
• Configure session timeouts (recommended: 30-minute idle, 8-hour max)
• Require MFA for admin accounts
• Restrict CORS origins to your actual domain

Grafana Access

By default, Grafana allows anonymous viewer access. For production:

1. Disable anonymous access in Grafana configuration
2. Configure Keycloak OIDC authentication for Grafana
3. Set up role-based access control for dashboards

OpenBao Access

• The OpenBao UI should not be exposed publicly (remove the secrets.* Caddy route)
• Use AppRole authentication exclusively; avoid root tokens in production
• Enable audit logging

Image Security

Scanning

Scan container images for vulnerabilities before deployment:

# Using Trivy
trivy image ghcr.io/100monkeys-ai/aegis-runtime:1.2.3
trivy image ghcr.io/100monkeys-ai/aegis-temporal-worker:1.2.3
trivy image ghcr.io/100monkeys-ai/aegis-seal-gateway:1.2.3

Pinned Versions

Always use pinned semver tags in production, never :latest:

# In .env
AEGIS_IMAGE_TAG=1.2.3

Monitoring & Alerting

Verify that all Prometheus alert rules are active:

# Check alert rules via Prometheus API
curl http://localhost:9090/api/v1/rules | jq '.data.groups[].rules[].name'

Configure alert routing in Prometheus Alertmanager for your notification channels (PagerDuty, Slack, email).

See Also

• Caddy Edge Proxy — TLS and domain routing
• Observability — monitoring and alerting
• Backup & Restore — data protection procedures
• Multi-Node Deployment — cluster security