Max Ronzhin 5e42f6d11b deploy: require redis auth (--requirepass) across all consumers ...

Redis without a password was the root cause of the security incident
(cron miner via unauthenticated replication RCE, see
.forcc/deploy/SESSION2-FINDINGS.md). Loopback binding alone doesn't
protect against a compromised container inside the same compose
network, so wire REDIS_PASSWORD as a required secret everywhere redis
is used: backend/worker/worker-transcriber(-gpu), redis-exporter,
livekit and egress (via rendered templates). docker compose now
refuses to start without it instead of silently running unauthenticated.

2026-07-25 22:59:34 +03:00

1.9 KiB

Raw Blame History

View Raw