Canopy
Canopy

Architecture and hardware requirements

This document acts as a reference point for the logical design of Canopy, and also provides guidelines on specific deployment scenarios.

Architecture

Canopy is comprised of three main components:

  • Application/web service (web tier, including application server and local file storage system)
  • Database layer
  • Document generation service (DOCX and PDF)

It is possible to run all three components on the same hardware - assuming the minimum requirements are met and planning of storage is undertaken. However, it is equally possible to deploy Canopy in different configurations - e.g. placing the web tier and database service on different services and storage on a NAS/SAN.

Alternative deployment guides will be made available shortly. For any specific questions, please contact support@checksec.com.

Logical design

image0

Services and Ports

Canopy communicates over the following TCP ports:

Service Group Service Port (Protocol) Publicly Accessible? Security Notes
Canopy application server Web Server 443 (https) Yes Yes - hardened TLS configuration out of the box

This is a standard web service, running on nginx by default (Apache also supported). It is also the primary, and only, interface that needs to be accessible to users of the application. The Web Service acts as a reverse proxy to the Application Service, for both user access and API (RESTful) access.

A self-signed certificate is used by default, which should be replaced with a production ready certificate.

Canopy application server Application Service 8000 (http) No Localhost configuration by default. The Application Service is built on top of Django and is typically bound to localhost only. If network communication is required (e.g. for large scale deployments), this service is wrapped (reverse proxy) via another Web Server layer, which would use the default TLS hardened configuration.
Canopy application server RabbitMQ server 5672 (amqp) No Localhost configuration by default; default username/password.

RabbitMQ is a backend message queue for running asynchronous jobs via Celery.

RabbitMQ can be configured to run over TLS, which may be a requirement under larger/enterprise deployments. Specific guidelines are available on the RabbiMQ site: https://www.rabbitmq.com/ssl.html

It is recommended that the default username/password be changed on install, even though the service is restricted to localhost.

Canopy database server PostgreSQL (default) 5432 (pgql) No Localhost configuration by default; default username/password accessible through a user-restricted admin script.

PostgreSQL is the primary database supported by Canopy. Oracle may also be used (REF).

Additional PostgreSQL hardening guidelines are provided at: REF.

Todo

Add references

Canopy report server Docserver 8181 (http) No Localhost configuration by default; no authentication required.

This service accepts a DOCX document template and an XML data source and returns a generated DOCX file to the Application Service.

This service can be run on an alternative server (for load distribution). In such a scenario, we recommend using nginx as a front-end proxy, which can be secured via TLS.

Canopy report server PDF converter 9016 (http) No Localhost configuration by default; no authentication required.

This service accepts a DOCX and returns a DOCX and PDF to the calling application.

This service can be run on an alternative server (for load distribution). In such a scenario, we recommend using nginx as a front-end proxy, which can be secured via TLS.

Other Mail routing 25 (smtp) No Outbound only service, for mail routing. This is a dependency for sending email-based notifications to users. Outbound firewall requirement.

Deployment scenarios

Single server

By default Canopy will set up a single server instance using the standard service protocols listed above.

Larger and enterprise deployments

Within enterprise environments, service layers may be available for databases. Canopy supports separation of the following modules on separate servers:

Web server
the web server can be run on its own instance. The web server configuration would need to be configured to connect to the application server on the exposed port (default: 8000). Multiple servers can be deployed in high availability environments.
Application server
the application server can be configured on a separate server.
Database server
Canopy requires a single database server. This database can be hosted on a network connected server. The database URL and port must be configured in the canopy.ini file on the application server. Database replication is not currently supported.
Report server
both the Docserver and the PDF converter can be deployed to a separate server (or servers) in order to offload the resource intensive operation of document generation. Both of these services can be deployed using TLS to encrypt network communications.

For configuration guidelines, see: TBC.

Todo

Add link above.