Clarity needed: exposed ports, ssl/https, LetsEncrypt, Certificates, Docker, nginx, proxy, inter-host comms and user security and privacy

Hi all,

First post so please be nice :wink:

I’d like to get some clarity on exactly what the requirements are to achieve a privacy respecting deployment of YaCy, preferably on (the possibly unsupported) Docker deployment. To that end could I please ask the following questions so that I can possibly contribute the answers back to the documentation section of YaCy as I’d love to get involved and contribute back :slight_smile:)

  1. Deploying YaCy on Docker makes sense for me - https://hub.docker.com/r/luccioman/yacy/ - is a version that has over 1 million downloads and has run reliably for a long while - but is there an officially supported version planned and if so can we document it?

  2. Deploying YaCy at home or in the enterprise requires ports to be forwarded - but exactly what information is sent over the default non-SSL port of 8090 and why, in 2019, is a non-SSL(TLS) default still a thing? Can we make port 8091 with SSL/TLS trusted or self-signed the default?

  3. Can I remove http ports entirely and only use https/SSL ports (8091) - even if I don’t want to do point 4 below?

  4. If I want to use a proxy in combination with cert-bot to provide a free LetsEncrypt trusted-cert so that users of YaCy get search access only via a secure encrypted SSL/TLS search page from their browser then I’m left with a confusing scenario whereby the users come in over my proxy on 443 (https) but YaCy complains if the default unencrypted 8090 is unreachable from the internet, as it should be (after all, they’re being proxied over 443 for a reason!) If I then open 8090 so that YaCy is reachable from the public internet, and stops complaining, I’m now left with a search engine that users can browse over a unencrypted http channel as well as over 443 through the proxy. This isn’t expected or good practice. Is there a way to let YaCy know that it’s being proxied and can send ALL traffic through the proxy (and not an port on the YacY application itself that’s directly internet facing) with the benefit of a valid trusted LetsEncrypt certificate?

  5. YaCy hosts/nodes presumably communicate machine-to-machine over port 8090 (see point 1 above) but this isn’t private or secure and leaves inter-node communications and their search terms open to capture by ISPs/‘bad guys’ who could potentially poison search results or illegally/immorally spy on YaCy users. Can anyone correct me on this if I’m wrong and point to ways that this can be made better, more secure and more private?

To reiterate: I’m not here to rain on anyone’s parade - this is a great tool that’s much appreciated that I’d like to help make better :slight_smile: Whilst I’m not a coder I do have experience is Cyber-Security and user privacy so happy to help if useful and contributions well received :slight_smile:

thanks!