From ec006fe02000d2a23bed81b19c0fa76c3e59e95a Mon Sep 17 00:00:00 2001 From: Max Ronzhin Date: Sat, 25 Jul 2026 22:15:41 +0300 Subject: [PATCH] deploy: bind postgres/redis to loopback instead of 0.0.0.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both are only used inside the compose network (services reach them by name, postgres:5432 / redis:6379). Publishing on 0.0.0.0 exposed them to the internet — Docker's DNAT rules bypass ufw, so the ports were reachable despite the firewall having no allow rule for them. Bind the published ports to 127.0.0.1 so external access requires an SSH tunnel. --- deploy/docker-compose.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml index 6cc0884..fd872bd 100644 --- a/deploy/docker-compose.yml +++ b/deploy/docker-compose.yml @@ -14,8 +14,11 @@ services: POSTGRES_USER: ${POSTGRES_USER:-vidconf} POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-vidconf} POSTGRES_DB: ${POSTGRES_DB:-vidconf} + # Публикуем ТОЛЬКО на loopback: postgres нужен внутри compose-сети + # (backend/worker обращаются по имени `postgres:5432`). Доступ снаружи — + # через SSH-туннель. Публикация на 0.0.0.0 открывала БД в интернет. ports: - - "5432:5432" + - "127.0.0.1:5432:5432" volumes: - postgres_data:/var/lib/postgresql/data healthcheck: @@ -29,8 +32,12 @@ services: redis: image: redis:7 restart: unless-stopped + # Публикуем ТОЛЬКО на loopback: redis используется исключительно внутри + # compose-сети (backend/worker/livekit/egress по имени `redis:6379`). + # Публикация на 0.0.0.0 без пароля = открытый redis в интернет — вектор + # cron/replication-RCE (см. .forcc/deploy/SESSION2-FINDINGS.md). ports: - - "6379:6379" + - "127.0.0.1:6379:6379" volumes: - redis_data:/data healthcheck: