Max Ronzhin ec006fe020 deploy: bind postgres/redis to loopback instead of 0.0.0.0 ...

Both are only used inside the compose network (services reach them by name,
postgres:5432 / redis:6379). Publishing on 0.0.0.0 exposed them to the
internet — Docker's DNAT rules bypass ufw, so the ports were reachable
despite the firewall having no allow rule for them. Bind the published
ports to 127.0.0.1 so external access requires an SSH tunnel.

2026-07-25 22:15:41 +03:00

38 KiB

Raw Blame History

View Raw