Security Feature Requests

[peaklabs-dev]

I have some security-related feature requests:

• Add a Cloudflare integration -> So we can turn on a switcher on each app, service and container that only allows cf domains for traffic --> This could be done via a firewall or vhost whitelisting a file that dynamically pushes all Cloudflare IPs. It only allows traffic from the CF IPs to hit the site (everyone goes through CF proxies) all other connections get dropped immediately. This would be a great addition. Be sure to forward the real IPs from the CF to the container or service for the application-level firewall to work properly. https://www.cloudflare.com/ips/, https://www.cloudpanel.io/docs/v2/frontend-area/security/
• Add a CrowdSec WAF, IPS integration -> To manage bans and view stats directly in coolify and protect coolify and everything hosted on a coolify server from threats. https://www.crowdsec.net/
• IP Blocking -> On a service level and on a hole coolify instance level -> to block IPs or csv, hole list of IPs
• Basic Authentication -> Add a basic authentication in front of coolify (in the settings)
• Basic Authentication -> Add basic authentication in front of any service hosted on coolify, infornt of all containers and so on(databases, websites...)
• Add App based 2FA to coolify
• Add hardware security key based 2fa to coolify (yubikey)
• Custom SSL certificate for each application -> Add a menu item for each application where we can upload a custom SSL certificate. Not one menu for all, because many applications need many certificates. Support for Cloudflare SSL is probably needed in most cases.
• Wildcard SSL certificate for the wildcard domain of an environment
• Multi-user support with user roles
• Audit log everything literally every movement, every setting change everything each user does
• Add an Open APP sec WAF support to protect coolify and all services on it https://www.openappsec.io/
• Add 8G WAF support to protect coolify and all services on it
• Bots Blocking -> Add it on an application or on a full server level -> Let us block bots via their name for example FratBot
• fully site isolation of services each has its own site ssh user -> and with that, each service has its own file system --> this is probably done via docker if all services are containers -> But isolated everything
• Add a firewall tab to open and close ports for the server
• Restrict access to coolify to a specific IP only
• https://infisical.com/ --> Use this for secrets mangemnt -->maybe make an integration

[wp-coin]

what you describe above can be easily implemented with Authelia and fail2ban

[peaklabs-dev]

Not exactly, I am talking about the panel and on its own without 3 party services, integration with IPS like CorwdSec (the better fail2ban) for the panel would be great and stuff but I do not want to use additional services like authelia in front of coolify.

[Araxeus]

how would you integrate fail2ban with coolify?

[dir]

@Araxeus You'd wire it up to read the caddy or traefik access logs, here's a good caddy example:

https://muetsch.io/how-to-integrate-caddy-with-fail2ban.html

[N0rthg4t3]

One might as well integrate Crowdsec, Appsec and Teleport (or any other system) with Coolify once going with caddy.

More specifically, once you go with caddy, you can implement any kind of IPS and IAM constellation, most of the time independent of the app behind it (or at least depending on the integration level). It is basically the same as implementing some kind of reverse proxy with IPS and WAF functions in front of your app.

Although I would agree that these features implemented directly into Coolify would ease the setup of these things some sort and provide some security out of the box.

[peaklabs-dev]

@andrasbacsai Could you take a look at this and maybe implement some of them for the next release or until v4-beta.500?

[Paillat-dev]

I just started playing around with coolify, and I have to say that security features where one of the things that really blocked me. As soon as I started my app, seeing logs of all of the bots trying to wfuzz my app triggered me, as I am used to having things like crowdsec in front of everything. I look forward to more security features in the future. But I have to say that I really enjoy working with coolify, this thing is amazing.

[uncaney]

yeh we really need something like that