We have created an amateur software product related with monitoring and management of specific services. It has been made in Python and runs a web service as frontend to show the data in a nice way besides other things.
We have one problem that we did not solve yet, and is how to distribute it in a way that the virtual appliance cannot be manipulated (so that the code and settings cannot be changed or viewed). We have a bunch of options:
Provide this as a SaaS, sending the data remotely (completely discarded for obvious security reasons)
Build a server with custom hardware that would be physically secured so at least can't be easily manipulated (discarded for high costs)
Create a virtual appliance (i.e. pre-configured VM) with ciphered data, capped console and literally no way to reset user password (i.e. not able to access anything) besides other details
The third option is what I like most, but I am not sure how feasible it is. My intention is not to have a bulletproof virtual appliance which is impossible to manipulate but at least make it harder to do so.
The problem, I do not know where to start to make the virtual appliance more secure as this is a challenge I never had to face before. Could you give me some tips? Am I on the right path?