List of most to least secure ways of connecting to the Noodle service:

1. On a network not (even indirectly) connected to the internet.
   • online features will necessarily not work;
     • email
     • upgrade button
     • unsplash
     • auto ssh
     • etc
2. On a network only indirectly connected to the internet.
3. On a public network with a firewall or NAT port forwarding blocking all but one port.
4. On a public network.

Public network security options:

• HTTPS
• DNS CAA records
• HTTP headers (content-security-policy, strict-transport-security, etc)
• White list
• Auto blacklisting enabled.
• "Session Security Level" to 4 (prevent session hijacking).
• IWA or 2 factor authentication.
• "Minimum password length" to 8 (make password guessing harder).
• Encrypted VPN or ssh tunnel.
• Anonymity networks like tor can be used, optionally with ssl or ssh (in practice will prevent anyone, including governments, from knowing what server a user is talking to).

• • Instead of downgrading we encourage you to report issues and then upgrade to a fixed version.
  • A new unwanted feature can often be made optional by adding a setting to disable it.
  • To test customizations against a new version we recommend cloning the VM or DB to a test instance to try the upgrade out before applying it to the production version.
  • If only the last number of the version has changed, downgrade by replacing its lib directory with the old version.
  • If the second number in the version changes reverting the database structure will require a custom build.

Windows example of converting a Tomcat SSL certificate to Apache :

keytool -storepass 123 -keystore noodle.pfx -export -alias domain.tld -rfc -file cert.pem

keytool -storepass 123 -keystore noodle.pfx -export -alias root -rfc -file fullchain.pem
openssl pkcs12 -in noodle.pfx -nocerts -nodes > privkey.pem

Official keytool manual

Official openssl manual