🚀 Now We Move To Phase 7 (Production-Hardening)

[vimal-java-dev]

🎯 What Phase 7 Will Include

In the new thread, we will implement:

1. Switch to prod profile
2. Secure DB configuration
3. Remove Postgres public port exposure
4. Commit SHA image tagging
5. Clean redeploy strategy
6. Prepare for reverse proxy + SSL (next phase)

[vimal-tech-starter]

Assign me.

[vimal-tech-starter]

🎯 Phase 7 — Controlled Hardening Plan

• ✅ Step 1 — Removed Public Database Exposure (Do This First)
• ✅ Step 2 — Binded Spring Boot to Localhost Only

🏗 Target Secure State (After Step 1 & 2)

Internet
↓
VPS
↓
(no direct access to 8080 or 5432)

• ✅ Step 3 — Installed Reverse Proxy

🏁 Final Architecture (After This)

Internet
↓
Port 80 (Nginx)
↓
Spring Boot (127.0.0.1:8080)
↓
PostgreSQL (Internal Docker Network Only)

🔴 STAGE 1 — Secure PostgreSQL (Critical)
❌ Current (Unsafe)

🟠 STAGE 2 — Hide Spring Boot Port
❌ Current

==============
1. ✅ Redeploy Again
2. 🟡 STAGE 3 — Install Reverse Proxy
3. 🟢 STAGE 4 — Configure Reverse Proxy

sudo nano /etc/nginx/sites-available/contact-api

🟣 STAGE 5 — Switch to Production Profile
🔵 STAGE 6 — Architecture After Hardening
Internet
↓
Port 80 → Nginx
↓
127.0.0.1:8080 → Spring Boot
↓
Docker Network → PostgreSQL

📌 Updated Full docker-compose.yml (Secure Version) on VPS

---

🧱 Step 1 — Installed Nginx on VPS
On Ubuntu VPS:

🔒 Step 2 — Closed 8080 Public Access
First, confirm the firewall:

⚙️ Step 3 — Configured Nginx Reverse Proxy
Edit config:
sudo nano /etc/nginx/sites-available/contact-api
-> Nginx Reverse Proxy Failed to hit URL below
-> Not work: http://{IP}/swagger-ui/index.html
-> Configured again and went to step 4
-> Work: -> http://{IP}/swagger-ui/index.html

🔐 Step 4 (Next) — Added HTTPS

🧠 Final Production Architecture
Browser
↓
HTTPS (443)
↓
Nginx (TLS termination)
├── Static files
└── Proxy → Spring Boot
↓
PostgreSQL (internal only)

This is a real production structure.

[vimal-tech-starter]

🎯 Phase 7 — Controlled Hardening Plan

• ✅ Step 1 — Removed Public Database Exposure (Do This First)
• ✅ Step 2 — Binded Spring Boot to Localhost Only

🏗 Target Secure State (After Step 1 & 2)

Internet ↓ VPS ↓ (no direct access to 8080 or 5432)

• ✅ Step 3 — Installed Reverse Proxy

🏁 Final Architecture (After This)

Internet ↓ Port 80 (Nginx) ↓ Spring Boot (127.0.0.1:8080) ↓ PostgreSQL (Internal Docker Network Only)

🔴 STAGE 1 — Secure PostgreSQL (Critical) ❌ Current (Unsafe)

🟠 STAGE 2 — Hide Spring Boot Port ❌ Current

============== **

1. ✅ Redeploy Again
2. 🟡 STAGE 3 — Install Reverse Proxy
3. 🟢 STAGE 4 — Configure Reverse Proxy**

sudo nano /etc/nginx/sites-available/contact-api

🟣 STAGE 5 — Switch to Production Profile
🔵 STAGE 6 — Architecture After Hardening
Internet
↓
Port 80 → Nginx
↓
127.0.0.1:8080 → Spring Boot
↓
Docker Network → PostgreSQL

📌 Updated Full docker-compose.yml (Secure Version) on VPS

🧱 Step 1 — Installed Nginx on VPS On Ubuntu VPS:

🔒 Step 2 — Closed 8080 Public Access First, confirm the firewall:

⚙️ Step 3 — Configured Nginx Reverse Proxy Edit config: sudo nano /etc/nginx/sites-available/contact-api -> Nginx Reverse Proxy Failed to hit URL below -> Not work: http://{IP}/swagger-ui/index.html -> Configured again and went to step 4 -> Work: -> http://{IP}/swagger-ui/index.html

🔐 Step 4 (Next) — Added HTTPS

🧠 Final Production Architecture Browser ↓ HTTPS (443) ↓ Nginx (TLS termination) ├── Static files └── Proxy → Spring Boot ↓ PostgreSQL (internal only)

This is a real production structure.

🚀 We have to implement of CROS

Because the frontend and backend are hosted on different origins.

• vimaltech.dev → GitHub Pages (Frontend)
• api.vimaltech.dev → VPS (Spring Boot via Nginx)

[vimal-java-dev]

• Below are all PRs that belong to phase 7,
• And those have been merged and closed successfully.
• 🚀 Now We Move To Phase 7 (Production-Hardening) #16
• 🚀 Now We Move To Phase 7 (Production-Hardening) #17
• Changes made in CorsConfig.java file #19