Firewall, HTTPS and failover: which problem does each solve?

A firewall controls allowed connections

Network firewall rules permit or block connections using properties such as source, destination, protocol and port. HTTP and HTTPS must reach the public website entry point. Databases and internal services should usually accept only authorized application connections over a private network.

Do not copy another project’s port list. Identify each dependency, document the rules and test changes before closing administrative access. Exposing PostgreSQL publicly merely to simplify connectivity increases the attack surface.

HTTPS and a WAF have different roles

HTTPS encrypts transport to the TLS termination point and helps authenticate the domain. It cannot fix a missing authorization check in your API. A web application firewall inspects HTTP requests and may block suspicious patterns; it does not replace input validation, parameterized queries or application access control.

Devora provisions HTTPS after the required domain setup and validation. This does not imply that a configurable WAF is available in the dashboard: check the actual product capabilities before promising that protection.

Failover is about recovery

Failover transfers service to a standby environment. A cold copy must start before serving traffic; an active copy already consumes resources. DNS, routing, database connectivity, sessions and files must work at the destination. Two copies on one machine cannot protect against losing that machine.

Local files do not automatically appear in another region. Use appropriate shared state, such as a managed database and S3, when preparing to scale or recover. Backups serve a different purpose: recovering deleted or corrupted data, including errors that replicate.

Before an AI assistant deploys

• Share the token privately with your chosen assistant; exclude tokens and .env from the ZIP.
• Keep database passwords out of source code and logs.
• Test public HTTPS and a real operation such as login, not only the homepage.
• Check where uploads, sessions and queues live before enabling extra copies.
• Verify backups and restore into an isolated environment.
• Revoke the token when finished and monitor logs after deployment.

A token lets the assistant deploy through your account API. It does not perform a complete security audit of the application. Review code changes and permissions before using real customer data.