Enable Swarm overlay network encryption (#122)

Author: Wiktor Maj

CHANGELOG.md

@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * Dependabot updates for `github-actions` and `terraform` ecosystems. (#29)
 * CI workflow to build and push service images to GitHub Container Registry on master merge. (#97)
 * Pull-first with local build fallback for container images during deployment. (#97)
+* Swarm overlay network encryption via IPsec and explicit data path port. (#92)
 * MySQL slow query log for queries exceeding 10 seconds or not using indexes. (#76)
 * Strengthen MySQL superset password: secrets module, expanded charset, 24 chars. (#89)
 * SQL Lab query row limits, timeout caps, and validation timeout. (#81)

docs/ARCHITECTURE.md

@@ -133,6 +133,7 @@ Redis and Superset run on the `superset-network` overlay network, which provides
 
 * Service discovery: Superset connects to Redis using the hostname `redis`.
 * Port publishing: Swarm publishes port 443 on all Swarm nodes via VIP-based routing.
+* IPsec encryption: all inter-container traffic is encrypted at the network level (`encrypted: true`).
 
 | Port | Protocol | Service | Scope |
 |------|----------|---------|-------|

docs/SECURITY.md

@@ -116,6 +116,8 @@ sources.
 - Only port **443** (HTTPS) is intended to be exposed externally on the management nodes.
 - MySQL (port 3306) and MySQL Router (port 6446) communicate over the internal network only.
 - Redis (port 6379) is accessible only within the Docker Swarm overlay network (`superset-network`).
+- The `superset-network` overlay is created with `encrypted: true`, enabling IPsec ESP encryption for all
+  inter-container traffic (Superset ↔ Redis). The Swarm data path uses port 4789 (VXLAN).
 - Gunicorn (port 8088) binds to `localhost` only, accessible exclusively through the Nginx reverse proxy.
 - IPv6 should be disabled or configured to be non-routable to prevent unintended network exposure.
 - DNS resolution between nodes is required for InnoDB Cluster group replication and SSH connectivity.

src/container.py

@@ -387,10 +387,18 @@ def __init__(self, client: docker.client.DockerClient, virtual_ip_address: str)
                 self.healthcheck_retries = 5
 
             def initialize_swarm(self) -> None:
-                self.client.swarm.init(advertise_addr=self.virtual_ip_address)
+                self.client.swarm.init(
+                    advertise_addr=self.virtual_ip_address,
+                    data_path_port=4789
+                )
 
             def create_network(self) -> None:
-                self.client.networks.create(name='superset-network', driver='overlay', attachable=True)
+                self.client.networks.create(
+                    name='superset-network',
+                    driver='overlay',
+                    attachable=True,
+                    options={"encrypted": "true"}
+                )
 
             def run(self) -> None:
                 self.initialize_swarm()