Skip to content

Platform Security & Isolation

Security architecture and protection measures implemented across the JengaStack hosting infrastructure.

Security Controls

  1. Network Segmentation: Tenant containers operate inside isolated Docker bridge networks without direct inter-tenant communication.
  2. Non-Root Execution: Odoo worker processes run under dedicated unprivileged system users (odoo:odoo).
  3. Encrypted Secrets: Sensitive API credentials (M-Pesa Consumer Keys, KRA Signing Keys) are encrypted at rest using AES-256-GCM.
  4. Automated SSL/TLS 1.3: All incoming connections are strictly forced to HTTPS with HSTS (HTTP Strict Transport Security) enabled.
  5. Rate Limiting: Inbound login endpoints and API routes are rate-limited at the Traefik proxy layer to block brute-force attempts.
  6. Tailscale Zero-Trust Control Plane: Administrative access and database maintenance occur exclusively over private Tailscale WireGuard tunnels.