Skip to content

docs(self hosting): add security section (@fehmer) #8264

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fehmer wants to merge 2 commits into
base: master
Choose a base branch
from
+25 −0
Open

docs(self hosting): add security section (@fehmer) #8264

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7e3707c
docs: add security section to self hosting guide (@fehmer)
fehmer Jul 6, 2026
4ed4f9e
toc
fehmer Jul 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions docs/SELF_HOSTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
- [Prerequisites](#prerequisites)
- [Quickstart](#quickstart)
- [Hosting over the network (HTTPS)](#hosting-over-the-network-https)
- [Security](#security)
- [Account System](#account-system)
- [Setup Firebase](#setup-firebase)
- [Update backend configuration](#update-backend-configuration)
Expand Down Expand Up @@ -61,6 +62,30 @@ docker compose up -d --force-recreate
> After updating your configuration and recreating the containers, clear your browser cache or perform a hard reload (Ctrl + F5) to make sure your browser isn't running an old cached version of the frontend.


## Security

Do not expose the Monkeytype backend directly to the internet. Instead, place it behind a reverse proxy and configure the backend to only accept connections from the reverse proxy.

The backend's built-in rate limiting is based on the authenticated user's `uid` or, for unauthenticated requests, the client's IP address.

To determine the client's IP address, the backend checks the following sources in order:

1. `CF-Connecting-IP` (when requests are proxied through Cloudflare)
2. `X-Forwarded-For`
3. The source IP address of the HTTP connection

We recommend the following configuration:

- If you are **not** using Cloudflare, remove any incoming `CF-Connecting-IP` header in your reverse proxy before forwarding requests.
- Configure your reverse proxy to set the `X-Forwarded-For` header to the client's IP address.
- Configure the backend to only accept connections from the reverse proxy to prevent clients from spoofing trusted headers.


Sources:
- [cloudflare documentation for cf-connecting-ip](https://developers.cloudflare.com/fundamentals/reference/http-headers/#cf-connecting-ip)
- [handling headers in traefik](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/headers)


## Account System

By default, user sign-up and login are disabled. To enable this, you'll need to set up a Firebase project.
Expand Down
Loading