Suggestion for client-server architecture improvements in Bespokefit.

[hmacdope]

Description

Currently bespokefit does its celery worker communication by exposing a redis message broker port to the outside world. This is perfectly fine when operating locally or on HPC.

However this is less ideal when operating on the open internet (e.g when deploying as a webserver). Exposing the database HTTP port is rather insecure.

Instead the communication to the celery workers should be mediated through the gateway whereby workers target a gateway endpoint and then the communication is routed to the celery message broker without exposing the broker itself.

This would require quite a bit of work, but just thought I would write it up for posterity.