Reference Notes on Cloud Networking & Security

1. Hardened TLS 1.3 & HTTP Security Baseline

Production edge proxies enforce TLS 1.2 and TLS 1.3 with strict transport security (HSTS), MIME-sniffing protection, frame-ancestors restrictions, and explicit CAA DNS authorization records (`issue "letsencrypt.org"`).

ssl_protocols TLSv1.2 TLSv1.3;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

2. Zero-Trust Overlay & Kernel UDP GRO Optimization

For Linux gateways forwarding encrypted overlay traffic, enabling UDP Generic Receive Offload (GRO) forwarding on the primary network interface significantly improves packet throughput and reduces CPU context-switching overhead:

ethtool -K enp0s6 rx-udp-gro-forwarding on rx-gro-list off

3. Structured Observability & Correlation Propagation

Services emit structured JSON telemetry with deterministic `correlation_id` attributes propagated across HTTP headers, message queues, and database sessions to enable sub-second root-cause isolation.