Kong Gateway - Hardened DB-less API Gateway

What is Kong Gateway

Kong Gateway (OSS) is a cloud-native API gateway and reverse proxy built on OpenResty (NGINX + LuaJIT). It routes, secures and observes API traffic between consumers and upstream services, with bundled plugins for key-auth, JWT, ACL, rate-limiting, request and response transformation, CORS, Prometheus metrics and OpenTelemetry. API consumers connect to the proxy data plane, while operators manage configuration through the Admin API using the deck CLI or a declarative YAML file. This image runs in DB-less mode: configuration lives in a single declarative /etc/kong/kong.yml, so there is no database to deploy, secure or operate. Apache-2.0 license, no per-API fees, no vendor lock-in.

Why self-host Kong Gateway

Running Kong on a VM you control keeps every API request - and the credentials, tokens and customer data it carries - inside your own tenant rather than a managed gateway service. Self-hosting suits teams with data residency requirements, organisations operating under GDPR, HIPAA or ISO 27001, and any product where the API edge must stay within your own perimeter with no per-call fees. Kong Gateway is Apache-2.0, fully auditable, with no vendor lock-in.

What this VM image adds

Security hardening:

• Admin API bound to 127.0.0.1 only - the control plane is never exposed; remote management goes through an nginx TLS + HTTP Basic Auth perimeter on 443
• Single admin credential generated at first boot, stored in /root/kong-credentials.txt (mode 0600) - no default password
• DB-less declarative config - /etc/kong/kong.yml, no database to deploy, secure or expose
• Proxy data plane on 8000 (HTTP) and 8443 (HTTPS) - the buyer-facing ports where API consumers connect
• Self-signed TLS certificate generated at first boot and replaceable with your own CA-signed certificate (certbot is pre-installed)
• Anonymous usage reporting disabled - no telemetry leaves the VM
• CVE scan - every image is scanned with Trivy before release
• UFW firewall - TCP 22 (SSH), 443 (Admin perimeter), 8000/8443 (proxy) only; the raw Admin API ports 8001/8444 are denied externally
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access, PermitRootLogin no, LoginGraceTime 60
• Kernel hardening - SYN cookies, ASLR, rp_filter, kexec disabled, IPv6 off
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json with Kong pinned by version, PURL, Apache-2.0 license, supplier and hash
• CIS Conformance Report at /etc/lynxroute/cis-report.html (OpenSCAP, Azure tailoring profile, 0 FAIL rules)
• Tailored CIS profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Operator credentials file at /root/kong-credentials.txt (mode 0600) with the admin Basic Auth credential and the Admin API perimeter URL

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 recommended)
2. Open NSG: TCP 8000/8443 from your API clients, TCP 443 from your management IPs, TCP 22 from your management IPs only
3. SSH: ssh -i key.pem azureuser@<PUBLIC_IP>, then sudo cat /root/kong-credentials.txt for the admin password
4. Manage Kong over the Admin API perimeter: curl -k -u admin:<password> https://<PUBLIC_IP>/, or push a full config with the deck CLI
5. Add a service and route in /etc/kong/kong.yml, run sudo kong reload, then send traffic through the proxy: http://<PUBLIC_IP>:8000/your-route or https://<PUBLIC_IP>:8443/your-route

The raw Admin API stays bound to 127.0.0.1:8001/8444; nginx is the TLS perimeter on 443 - do not expose 8001/8444 directly. Kong Manager (web console) is an Enterprise feature and is not enabled; manage via the Admin API or the declarative kong.yml. Replace the self-signed certificate with a CA-signed one for production.