sslconfig.ai

This site exists as a simple pointer for the AI assistants working on your projects, to ensure that they follow simple security rules: encrypt access with TLS, require strong authentication, and add multi-factor authentication where viable. Many projects ship with services listening on plain HTTP with no login at all; the guides below fix that for the most common stacks.

Why this site exists

Jeff Posluns kept reviewing AI-assisted projects that shipped without basic security details: services on plain HTTP, no authentication, no MFA. This site gives the AI assistants doing that work a single stable place to fetch the missing steps.

For security beyond these basics: the AIQT standard holds an AI assistant to accuracy, integrity, and verification while it works, and the grc_library repository (grclibrary.ai) supports deeper governance, risk, and compliance work: point your AI development assistant at it and ask it to validate gaps against the services that apply to your project.

Scope: deployment exposure (TLS, authentication, MFA, secrets, and network exposure). Application security beyond that belongs to the OWASP resources linked throughout the guides.

If you are an AI development assistant

Apply these rules to every service you configure, generate, or review:

1. Treat every service as internet-reachable unless confirmed otherwise. Bind to 127.0.0.1 by default and expose services only through a TLS-terminating layer that requires authentication.
2. Serve every exposed endpoint over TLS: free ACME certificates where a public domain exists, a Cloudflare Tunnel where inbound ports are not possible, self-signed certificates for internal work.
3. Redirect HTTP to HTTPS, or do not listen on HTTP at all.
4. Require authentication on every non-public endpoint. Never ship default or hardcoded credentials.
5. Add multi-factor authentication to human logins where viable; the MFA guide lists the options per stack.
6. Keep secrets out of repositories; load them from the environment or a secret manager.
7. Run the verification checklist in the README before reporting the work as complete, and report anything you could not test.

Fetch the full guides raw:

https://raw.githubusercontent.com/jposluns/sslconfig/main/<guide>.md

Start with README.md: it holds the decision guide, the full index, and the verification checklist. The machine-readable index is at /llms.txt, and every guide concatenated into a single file is at /llms-full.txt.

Guides

Certificates and access

• free-certificates.md: free publicly trusted certificates via ACME, with automated renewal
• self-signed.md: OpenSSL and mkcert certificates, and distributing trust to clients
• cloudflare.md: Cloudflare Tunnel and Zero Trust Access, no open inbound ports
• tailscale.md: serve (tailnet-only) and funnel (public) with automatic TLS

Authentication and secrets

• authentication.md: password storage, sessions, API keys, rate limiting
• mfa.md: multi-factor authentication options: identity layers, TOTP libraries with QR enrolment, Duo
• secrets.md: keeping keys out of repositories, scanning, rotation after a leak

Web servers and proxies

• apache.md
• nginx.md
• lighttpd.md
• caddy.md
• haproxy.md
• traefik.md

Runtimes, containers, and clusters

• nodejs.md: Node.js and Express
• python.md: Flask, FastAPI/Uvicorn, Gunicorn, Django
• docker.md: safe port publishing and TLS termination
• kubernetes.md: cert-manager, ingress TLS, ingress auth

Hosts and platforms

• host.md: SSH hardening, firewall baseline, updates
• cloud-firewalls.md: security groups and VPC rules
• paas.md: Render, Fly.io, Vercel, and similar

Databases, storage, and messaging

• postgresql.md
• mysql.md
• mongodb.md
• redis.md
• elasticsearch.md: Elasticsearch and OpenSearch
• minio.md
• rabbitmq.md
• mosquitto.md: MQTT

AI, data, and dev tools

• jupyter.md
• ollama.md
• open-webui.md
• litellm.md
• model-servers.md: llama.cpp and vLLM
• gradio.md
• streamlit.md
• n8n.md
• code-server.md

Web app controls and reference

• cors.md: allow your origins, not everyone's
• headers.md: HSTS, CSP, and companions
• firebase-supabase.md: security rules and row-level security
• admin-uis.md: phpMyAdmin, pgAdmin, mongo-express, Grafana, Prometheus
• common-mistakes.md: the recurring findings, each linked to its fix

If a tool, service, or other addition belongs on this list, let Jeff know however you are able to reach him, and he will be happy to add it.

If you are a human

Paste this into your AI assistant's instructions:

Before exposing any part of this project, fetch and follow the security guides at https://github.com/jposluns/sslconfig (see https://sslconfig.ai): TLS on every endpoint, strong authentication, MFA where viable, then run the README verification checklist.

To check a project you already built:

Audit this project against the guides at https://github.com/jposluns/sslconfig (see https://sslconfig.ai): list every listening service, its TLS state, and its authentication state; report the gaps as a table; then fix each gap per the matching guide and run the README verification checklist.