Documentation on limiting API traffic to internal-only?

[greg]

Hi,

Not by default. It would depend on how your Node app is running. Most will have http.createServer (in some kind of app.js or equivalent) and so will use http, likely on 3000 or 8080.

If you want https internally you could try changing that to https.createServer … and so would need to provide that with a key and cert in its options. See e.g HTTPS | Node.js v21.2.0 Documentation.

Do you need to do that? I’d say no since …

Internal Network Security

We run a WireGuard mesh between all of our hosts; once traffic hits our edge, there’s no point at which it goes back out over the Internet in plaintext. That goes for traffic between apps as well, though you should know that two apps on the same host will be speaking directly to each other (in plaintext) over the host’s local routing. If you want more assurance than that, you can build an image that does TLS or WireGuard between your apps; it’s probably not worth it, but it’s a thing you can do…