All projects

Inforisk: building, securing and modernising the production platform

From physical servers to a rebuildable, monitored and hardened platform: Proxmox and Ceph, Ansible, WAF and anti-bot, dynamic firewall, isolated network, and a team trained to carry on.

Company
Inforisk
Period
2012–2018
Stack
  • Proxmox
  • Ceph
  • Ansible
  • WAF
  • ipset
  • pfSense
  • Zabbix
  • Debian

Context

Inforisk publishes financial and legal information on companies. Its platform served public websites and business applications on dedicated servers. I was in charge of its infrastructure: availability, security, costs and the team’s ability to run it.

Virtualisation and Infrastructure as Code

  • Migration from physical servers to virtualisation (vSphere, then Proxmox), with a Proxmox cluster on replicated, secured Ceph storage.
  • VM deployment fully automated with Ansible, and the infrastructure codified so it can be rebuilt automatically.
  • Migration of many critical services to Debian.

Security

  • WAF: ModSecurity integrated with ELK, then a new version with a false-positive corrector, custom rules and anti-bot / bad-bot protection.
  • Highly available web entry tier with Keepalived/VRRP on the private network; SSL certificates automated with Ansible.
  • Dynamic firewall based on ipset with behavioural detection, blocking abusive sources automatically.
  • VPNs on pfSense, and an isolated private network with unnecessary public access disabled.
  • Traceability: user actions on critical servers tracked, logs centralised (Elasticsearch, Logstash, Kibana, rsyslog).
  • Identity and access: OpenLDAP, FreeIPA, SSH and firewall policies.

Data, backups and operations

  • PostgreSQL replication (RepMgr, PgPool) and tuning; Tomcat JVM tuning.
  • Backup and restore with Bacula on NFS across several sites; business continuity and disaster recovery plans.
  • Monitoring platform (Zabbix) fully upgraded, with Nagios and custom checks, and alerting continuously improved to anticipate incidents.
  • PowerDNS for DNS.

People

  • Day-to-day support for the development team.
  • Trained a level-2 engineer so that he could, in turn, support the developers autonomously.
  • Documentation and procedures for everything above.

Outcome

Better availability and scalability, drastically reduced costs, a platform that can be rebuilt from code, and a team that does not depend on one person.