Deploy behind TLS and verify ephemerality #63

New issue

Closed

opened 2026-07-05 19:21:39 +01:00 by TimCane · 0 comments

TimCane commented

2026-07-05 19:21:39 +01:00

(Migrated from github.com)

Goal

Reverse proxy terminating TLS and forwarding the WebSocket upgrade + X-Forwarded-For without logging query strings; run the two-phone test on real phones; one hour post-finalize confirm redis-cli --scan empty and the MinIO bucket empty.

References

Done when

Advances M7 A4/A5 (final gate).

Part of M7: Hardening.

## Goal Reverse proxy terminating TLS and forwarding the WebSocket upgrade + X-Forwarded-For without logging query strings; run the two-phone test on real phones; one hour post-finalize confirm redis-cli --scan empty and the MinIO bucket empty. ## References - [docs/13-deployment.md#topology](https://github.com/TimCane/bill-splitter/blob/main/docs/13-deployment.md#topology) - [docs/13-deployment.md#operations](https://github.com/TimCane/bill-splitter/blob/main/docs/13-deployment.md#operations) - [docs/10-security-privacy.md#ephemerality-guarantees](https://github.com/TimCane/bill-splitter/blob/main/docs/10-security-privacy.md#ephemerality-guarantees) ## Done when - Advances M7 A4/A5 (final gate). --- Part of **M7: Hardening**.