Joplin – Architecture and security review

Case Study

SHARE

Background

Joplin is a widely respected free, open-source note-taking and to-do application that enables users to handle numerous notes efficiently, organised into notebooks. Its features include tagging, copying, modifying notes, and synchronisation across devices.

To support its 3500 active users and ensure a seamless, secure, and reliable experience, Joplin required a robust cloud infrastructure capable of scaling with user demand and protecting sensitive user data.

joplinapp.org

Problem Statement

Joplin Cloud faced significant challenges in two main areas:

  • Scalability and reliability

    Their infrastructure struggled to handle increasing user demand while ensuring application reliability. The application required re-architecting to a stateless design to enable auto-scaling.

  • Cost management and security

    They lacked effective cost-monitoring tools, leading to unpredictable expenses. Additionally, there were gaps in security practices, such as encryption and access control.

These challenges created risks for operational stability, cost inefficiencies, and data security vulnerabilities.

Proposed solution

Epitechnic performed a comprehensive AWS Well-Architected Review of Joplin’s production environment. The proposed solution included:

  1. Infrastructure Improvements:
    • Amazon CloudWatch: Deployed to monitor utilisation and set alerts when usage or costs exceed thresholds. ($5/month)
    • Elastic Load Balancer (ELB): Implemented for traffic distribution and improved application scalability.
    • Auto Scaling Groups (ASG): Enabled to ensure the application scales dynamically based on demand.
    • Amazon Elastic Cache: Suggested to enhance performance by caching frequently accessed data.
    • Amazon S3: Recommended adding VPC endpoints for S3 to improve file transfer performance within the AWS network.
  2. Reliability Enhancements:
    • Multiple Availability Zones (AZs): Configured for redundancy and fault tolerance, improving reliability and uptime.
    • Future plans for multi-region setup to support user growth.
  3. Cost Optimisation:
    • AWS Cost Calculator: Introduced to evaluate costs of new services and improve budget planning.
    • Cost-management education provided to the client’s team.
    • CloudWatch alerts set for spending thresholds.
  4. Security Enhancements:
    • AWS GuardDuty: Deployed to monitor threats and detect malicious activity. ($5/month)
    • AWS Systems Manager: Implemented for EC2 management and operational security. ($10/month)
    • TLS Encryption: Enforced for all traffic in transit.
    • AWS Key Management Service (KMS): Used for encryption at rest with AWS-managed keys.
    • Security Groups: Configured to restrict network access and allow only essential ports.
  5. Operational Excellence:
    • Provided education on AWS Secrets Manager, which will be implemented in the future to manage secure credentials.
    • A roadmap created for achieving a stateless application model to enhance scalability.

Metrics for success

  1. The success of the solution was measured using the following metrics:

    1. Operational Metrics: Increased uptime and system availability across multiple AZs.
    2. Cost Metrics: Reduction in monthly AWS costs due to better utilisation tracking and alerts.
    3. Security Metrics: Implementation of TLS encryption and reduced attack surface through tightened security group policies.

Lessons learned / outcomes

  1. Improved Scalability: Joplin’s infrastructure can now support growing user demands with ELB and ASG, providing a foundation for future multi-region expansion.
  2. Cost Transparency: Proactive cost monitoring has led to predictable monthly expenses, enabling better financial planning.
  3. Enhanced Security: The adoption of encryption at rest and in transit, combined with restricted access controls, significantly mitigates security risks.
  4. Knowledge Sharing: Joplin’s team is now equipped to use AWS tools like Systems Manager, GuardDuty, and the Cost Calculator effectively, reducing their reliance on external support.

Customer feedback

"Always keen to improve Joplin Cloud, we have recently reviewed its architecture in the context of the AWS Well-Architected Review. This was done in partnership with Epitechnic Ltd from London, who gave us valuable insights on how to improve the security and reliability of the Joplin Cloud infrastructure. We are very happy with this review - we have started implementing some of the changes and will continue doing so over the coming months."

Conclusion

The AWS Well-Architected Review conducted by Epitechnic  successfully addressed Joplin’s key challenges, delivering a more robust, secure, and cost-effective AWS environment.

This collaboration has laid the groundwork for Joplin Cloud to scale confidently while maintaining operational excellence and security.

More case studies