Skip to content

Security

Production security guidelines for Blacklake deployments.

Authentication

JWT Authentication

# .bl/config.yml
server:
  auth:
    enabled: true
    jwt_secret: "${JWT_SECRET}"
    token_expiry: 3600  # seconds
    algorithm: "HS256"

API Key Authentication

# .bl/config.yml
server:
  auth:
    enabled: true
    api_keys:
      - "your-api-key-here"
      - "another-api-key"

Data Protection

Encryption at Rest

# S3 encryption
s3:
  encryption:
    enabled: true
    kms_key_id: "arn:aws:kms:us-west-2:123456789012:key/12345678-1234-1234-1234-123456789012"
    sse_algorithm: "aws:kms"

Database Encryption

# PostgreSQL encryption
database:
  ssl:
    enabled: true
    mode: "require"
    cert: "/path/to/client-cert.pem"
    key: "/path/to/client-key.pem"
    ca: "/path/to/ca-cert.pem"

Network Security

TLS/SSL

# Server TLS
server:
  tls:
    enabled: true
    cert_file: "/path/to/cert.pem"
    key_file: "/path/to/key.pem"

CORS Configuration

# CORS settings
server:
  cors:
    origins: ["https://app.company.com"]
    methods: ["GET", "POST", "PUT", "DELETE"]
    headers: ["Authorization", "Content-Type"]
    credentials: true

Access Control

S3 Bucket Policies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:user/blacklake-user"
      },
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::blacklake-data/*"
    }
  ]
}

Database Permissions

-- Create restricted user
CREATE USER blacklake_app WITH PASSWORD 'secure_password';

-- Grant minimal permissions
GRANT CONNECT ON DATABASE blacklake TO blacklake_app;
GRANT USAGE ON SCHEMA public TO blacklake_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO blacklake_app;

Security Headers

# Security headers
server:
  security:
    headers:
      - "X-Content-Type-Options: nosniff"
      - "X-Frame-Options: DENY"
      - "X-XSS-Protection: 1; mode=block"
      - "Strict-Transport-Security: max-age=31536000; includeSubDomains"
      - "Content-Security-Policy: default-src 'self'"

Monitoring

Security Logging

# Logging configuration
server:
  logging:
    level: "INFO"
    format: "json"
    security_events: true
    failed_logins: true
    api_errors: true

Audit Trail

-- Audit table
CREATE TABLE audit_log (
  id SERIAL PRIMARY KEY,
  user_id TEXT,
  action TEXT,
  resource TEXT,
  timestamp TIMESTAMPTZ DEFAULT NOW(),
  ip_address INET,
  user_agent TEXT
);

Best Practices

Environment Variables

# Use environment variables for secrets
export JWT_SECRET="your-secret-key"
export DATABASE_PASSWORD="secure-password"
export S3_ACCESS_KEY="your-access-key"
export S3_SECRET_KEY="your-secret-key"

Secret Management

# Use external secret management
secrets:
  provider: "aws-secrets-manager"
  region: "us-west-2"
  secrets:
    - "blacklake/database/password"
    - "blacklake/s3/credentials"
    - "blacklake/jwt/secret"

Regular Updates

  • Keep dependencies updated
  • Monitor security advisories
  • Apply security patches promptly
  • Use automated dependency scanning

Compliance

GDPR Compliance

  • Data encryption at rest and in transit
  • User consent for data processing
  • Right to data portability
  • Right to data deletion

SOC 2 Compliance

  • Access controls and authentication
  • Data encryption and protection
  • Audit logging and monitoring
  • Incident response procedures

Incident Response

Security Incident Checklist

  1. Identify - Detect and confirm security incident
  2. Contain - Isolate affected systems
  3. Eradicate - Remove threat and vulnerabilities
  4. Recover - Restore normal operations
  5. Learn - Document lessons learned

Contact Information

  • Security Team: security@company.com
  • Emergency: +1-555-SECURITY
  • Incident Response: incident@company.com

Next Steps