Hardened an AWS Lightsail box for a Django consultancy before client handover
They build Django apps for a living and still wanted a second pair of eyes.
- Customer
- Django consultancy
- Team size
- 3 engineers
- Provider
- AWS Lightsail
- OS
- Ubuntu 24.04
- Plan · Duration
- Pro · 26 hours
A three-person consultancy migrating a client's Django app from a shared host to AWS Lightsail. They wanted hardening done by someone other than the team that built the app, before handing the box over to a non-technical client who would own it long-term.
Their selling point with the client was "we handle the boring stuff." They could absolutely have done this themselves — but the client was paying for an audit report from someone who hadn't written the code, and that report needed to be on company letterhead other than theirs.
What we found on the box.
First pass before changing anything. Severity ranges from critical (act immediately) to low (worth knowing).
-
critical
Django
DEBUG = Truein production settings -
critical
SECRET_KEYcommitted to a config repo with broader access than intended -
high
gunicornrunning asroot -
high
PostgreSQL listening on
0.0.0.0(Lightsail edge blocked it, but no defense in depth) -
medium
Lightsail firewall allowed all from
0.0.0.0/0on the app port -
medium
No log rotation; logs at 4.2GB on a 40GB disk
What we changed, in order.
Each change is reversible and documented in the handover doc. Commands shown are illustrative.
-
1
Set
DEBUG = False; enabled Django security middleware (HSTS,SECURE_SSL_REDIRECT, secure cookies,SameSite=Lax). -
2
Rotated
SECRET_KEYand moved configuration to a systemdEnvironmentFilewith restricted permissions. -
3
Re-ran
gunicornunder systemd as a dedicatedappuser. -
4
Bound PostgreSQL to
127.0.0.1, switched authentication toscram-sha-256. -
5
NGINX in front of gunicorn with rate-limiting on
/loginand/admin. -
6
UFW + Lightsail firewall: only the custom SSH port, 80, and 443 reachable.
-
7
logrotateconfigured for application, access, and error logs. -
8
Set up CloudWatch shipping for application logs so the client could see them post-handover.
The numbers that moved.
Representative figures from this engagement. Real, named-customer studies will publish actual numbers with a link to verify.
Other sample engagements
See all
Hand us your VPS, get an engagement like this one.
Pick a plan, send the credentials through the encrypted form, and we'll come back with the same kind of audit + hardening + handover the studies above describe.