Isolated Stack

A fully isolated Docker stack with Nginx as a reverse proxy, a Python Flask app, and Redis — featuring IP-based access control and network-level database isolation.

Features

• IP Restriction – Nginx allows access only from a specified subnet (e.g., 192.168.1.0/24).
• Network Isolation – Redis runs on an internal Docker network with no internet access and no exposed ports.
• Reverse Proxy – Nginx proxies all traffic to the Flask app; the app port is never exposed directly.
• Visit Counter – Flask app increments a Redis-backed counter on each request.
• Health Endpoint – /health reports Redis connection status, accessible without IP restriction.
• Dockerized – Full stack runs with a single docker compose up command.

Quick Start

git clone https://github.com/younesmod/isolated-stack.git
cd isolated-stack
docker compose up -d

• App: http://<your-host-ip>:8080
• Health Check: http://localhost:8080/health

Architecture

Internet / Host (port 8080)

↓

[Nginx] ← IP restriction (192.168.1.0/24 only)

↓ frontend network

[Flask] ← Gunicorn, no exposed ports

↓ backend network (internal: true)

[Redis] ← No internet, no external access

Configuration

Edit IP restrictions in nginx/sites-available/webapp.conf:

allow 192.168.1.0/24;
allow 127.0.0.1;
deny all;

Verification

# App responds from allowed IP
curl http://192.168.1.x:8080

# Health endpoint (no IP restriction)
curl http://localhost:8080/health

# Redis reachable from app (should print True)
docker compose exec app python -c "import redis; r=redis.Redis(host='redis'); print(r.ping())"

# Redis has no internet access (should print Network unreachable)
docker compose exec redis ping -c 2 8.8.8.8

Cleanup

docker compose down -v

License

MIT © Younes Modaresian