209a Deployment Defaults

For all details about the makandra hosting environment, see the opscomplete documentation.

General

• We set specific environment variables to disable telemetry for various tools and libraries. See details.
• We enable jemalloc Show archive.org snapshot for improved memory management.

Ruby on Rails specific defaults

• Ruby and Node.js versions can be managed by the project itself. See capistrano-opscomplete Show archive.org snapshot for details.

• The following directories are linked to the shared filesystem:

  root@server:/var/www/acme_p# tree -d -L 2
  ...
  └── shared
      ...
      ├── public
      │   └── system -> /gluster/shared/acme_p/shared/public/system
      ├── storage -> /gluster/shared/acme_p/shared/storage
      └── system -> /gluster/shared/acme_p/shared/system
  

• Secrets

  • config/secrets.yml is created once and includes a randomly generated secret_key_base.
  • Rails credentials: For each environment, we automatically generate config/credentials/$RAILS_ENV.key These keys are managed by us.

Application servers

Note

This default is enabled for applications developed by makandra or new deployments created after September 7, 2026.
If Your deployment was created before that date and you would like to use this feature, please reach out to ops@makandra.de. We can enable it for Your deployment.

Static files served directly by the web server on an application server, for example files from an application's public/ directory, receive a Content-Type based on their file extension.

For security reasons, only a defined set of file extensions is served with a specific MIME type. All other files are served as:

Content-Type: application/octet-stream
Content-Disposition: attachment

This causes browsers to download unknown file types instead of displaying potentially active content.

All static file responses additionally receive:

X-Content-Type-Options: nosniff

This prevents browsers from ignoring the declared Content-Type and guessing another type from the file contents.

HTML and SVG files are supported, but receive an additional restrictive Content-Security-Policy because they may contain active content.

HTML files are served with:

Content-Type: text/html; charset=utf-8
Content-Security-Policy: sandbox

SVG files are served with:

Content-Type: image/svg+xml
Content-Security-Policy: sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src data:

The complete list of supported file extensions and their MIME types is attached to this card.

These defaults apply to files served directly by the web server. They do not restrict the Content-Type chosen by the application itself.

In particular, when a Rails controller uses send_file, Rails determines the Content-Type itself. For user-provided or otherwise untrusted files, we recommend sending them with an attachment disposition:

send_file @attachment.path, disposition: :attachment

This tells the browser to download the file instead of displaying it in a browser tab.

Load balancer

• All domains are served via SSL. By default, we use certificates provided by Let's Encrypt.
• HTTP traffic is automatically redirected to HTTPS.
• HSTS Show archive.org snapshot is enabled.
• Passive health checks are configured by default. Active health checks can be added on request. See details.
• The response header Cache-Control: public, max-age=31560000 (1 year) is applied to:
  • Paths starting with /assets/
  • Paths starting with /packs/
  • Requests for static assets (*.(css|eot|flv|gif|ico|jpe?g|js|otf|png|svg|swf|tiff|ttf|woff|woff2)) if the query string contains at least one digit, e.g. ?v=123.