# TLS & network policy

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/tls-and-network-policy

Enforce TLS everywhere, let the origin answer only to the edge in front of it and restrict network access between services to only what each one needs.

Usually comes after: [Secrets management](https://gradus.kazet.blog/tree/cloud-application/step/secrets-management).

Leads to: [Security headers](https://gradus.kazet.blog/tree/cloud-application/step/security-headers), [Rate limiting & WAF](https://gradus.kazet.blog/tree/cloud-application/step/rate-limiting).

## Prompt for your AI assistant

```
Ensure all external traffic is served over TLS 1.2 or later and that the edge verifies the origin's certificate rather than accepting any. Add an HSTS header, and before turning on includeSubDomains or preload write down in docs/ what each would mean for every other subdomain of this domain. Make the origin accept traffic only from the edge or load balancer in front of it, through the platform's ingress setting or a secret header the edge adds, and check that calling the origin directly fails. Define network policy rules that restrict traffic between services to the paths they need.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt