3 ms·
> internal, but by design usually accessible on the public internet Your API can be accessible obviously, but put ZeroMQ behind a firewall so only the API serv
by samtheprogram 2y ago
> internal, but by design usually accessible on the public internet
Your API can be accessible obviously, but put ZeroMQ behind a firewall so only the API server can reach it.
If it’s running on the same server, at least block the port ZeroMQ is listening on from the outside world.
- fragmede 2y agoPeople make fun of Kubernetes or "resume driven development" for making things more complex than they need to be, but this is why you want mTLS via a sidecar with short auto renewed certificates on a mesh inside your distributed system of a operating stack, when the system is big enough to justify that complexity. Something the size of, like, Airbnb should have that.
- theamk 2y agoOr a wireguard VPN. Or even just socat with mTLS inside systemd. There are easier ways to achieve that than kubernetes with sidecar mesh.