Security

Authentication and Authorization models

EngineeringOperations

What this does: Secures the platform with role-based access control, API key authentication (Argon2id), and network isolation — ensuring only authorized users can access predictions and admin tools.

The system enables secure access through Airflow’s native Role-Based Access Control (RBAC) and network isolation strategies.

​

Authentication Model

The platform uses Basic Authentication backed by Airflow’s session management.

docker-compose.yaml

AIRFLOW__API__AUTH_BACKENDS: "airflow.api.auth.backend.basic_auth,airflow.api.auth.backend.session"

​

User Provisioning

Initial admin users are provisioned during container startup via the airflow-init service.

User	Role	Access Level
Cole	Admin	Full System Access

​

Role-Based Access Control (RBAC)

We utilize the standard Airflow security model to segregate duties.

​

Network Security

Production Note: In the current Docker Compose setup, internal services like PostgreSQL and Redis are NOT exposed to the host machine, ensuring database isolation.

• Publicly Exposed:
  • Airflow Webserver (8080)
  • MinIO Console (9001)
• Internal Only:
  • PostgreSQL (5432)
  • Redis (6379)
  • Airflow Worker / Scheduler / Triggerer

​

Key Rotation & Generation

To simplify security management, we provide a utility script for generating cryptographically secure keys.

​

Usage

python scripts/generate_security_config.py

Output:

1. Airflow Fernet Key: "..."
2. Airflow Webserver Secret Key: "..."
3. MinIO Credentials: ...

This ensures that AIRFLOW__CORE__FERNET_KEY and other secrets are rotated safely before deployment.