Harden a fresh install

1. Lock the management screen to your networks

Check NFM_ADMIN_ALLOWLIST in .env on every node. It is checked before the login page renders, so a stolen password from the wrong network gets nothing.

grep NFM_ADMIN_ALLOWLIST /data/docker/failoverlb/.env

Include IPv6 forms if your staff might arrive over IPv6. An allowlist that only names IPv4 is the most common way people lock themselves out of their own system.

2. Change the first password and save the recovery codes

The installer prints a first password to the log once. Change it, and put the recovery codes somewhere that is not the phone you might lose. A password manager is good. Printed in a drawer is also fine.

3. Give people the smallest role

Viewer unless somebody genuinely needs more. Operator for the people who run the service day to day. Admin for a small number of people. It is easy to raise somebody later and awkward to explain an outage caused by an account that did not need the rights it had.

If your organization runs an identity provider, set up single sign on. Then the provider's lockout, its second factor and, most importantly, its leaver process actually apply here too.

4. Set the management networks

Settings, Management networks. These are what any access list with Include the management networks ticked will pick up, along with every cluster node from the roster. Setting them now means the node you add in six months lands in every one of those lists on its own.

5. Turn staging off, once you have a working certificate

Certificates start pointed at the Let's Encrypt practice service on purpose, because the real service allows five certificates a week for the same names with no way to appeal. Get one working, then switch it off in Settings and issue again.

6. Get the WAF rules and the country database onto every node

Both are files that live next to nginx, and a node without them refuses the whole configuration. Installing them now, from Settings, means the feature is available the day you want it rather than the day you need it.

Having them installed does not switch anything on. A site is only checked once its own WAF setting is turned on, and that starts in watching mode.

7. Take a backup, and put it somewhere else

Before you have anything worth losing. It takes ten seconds and it teaches you where the button is.

• Not only on the load balancers. A backup that lives on the machine it protects is no help when that machine is what failed.
• Somewhere access is controlled, because the file contains every private key the fleet holds.
• Somewhere you will still have access if you are locked out of this system, since restoring is how you get back in.

Also copy the .env file from each node somewhere safe and separate. It holds the secret key that unlocks stored passwords and authenticator seeds. Without it, a restored database cannot read its own encrypted values.

8. Test the failover on purpose

Stop the active node, in daylight, and watch what happens. Then bring it back. An hour spent on that is worth more than any amount of documentation, because a failover that has never been tried is a plan, not a capability, and the two look identical right up until the moment they do not.

And then, quarterly