Data in transit without encryption = readable by anyone on the network. TLS for web, mTLS for services, VPN/WireGuard for networks.

TLS — The Foundation¶

Encryption in Transit — Encrypting Data in Motion¶

server { listen 80; return 301 https://$host$request_uri; } server { listen 443 ssl; ssl_protocols TLSv1.2 TLSv1.3; add_header Strict-Transport-Security “max-age=63072000” always; }

WireGuard VPN¶

Server¶

[Interface] PrivateKey = server_private_key Address = 10.0.0.1/24 ListenPort = 51820 [Peer] PublicKey = client_public_key AllowedIPs = 10.0.0.2/32

• TLS 1.3 for web and API
• mTLS for service-to-service
• WireGuard for site-to-site VPN
• Database connections over TLS

Key Takeaway¶

Encrypt all network traffic. TLS for web, mTLS for services, WireGuard for VPN.