Changeset f99bbe8 in Klonkt

Timestamp:

06/23/2026 10:00:00 PM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

5eef817

Parents:

09ee2bd

Message:

security: bind to 127.0.0.1 by default behind a reverse proxy

New HOST env (default 0.0.0.0 for Docker/back-compat). The VPS installer now
writes HOST=127.0.0.1 and Docker maps the host port to loopback (127.0.0.1:3000:3000)
+ overrides HOST=0.0.0.0 inside the container — so the app is never reachable
directly on its port from the internet, only via the proxy. .env.example defaults
to 127.0.0.1 (manual installs); docs explain it. Existing installs hardened on
re-run of install.sh.

Co-Authored-By: Claude <noreply@…>

Files:

• .env.example (modified) (1 diff)
• README.md (modified) (1 diff)
• docker-compose.yml (modified) (1 diff)
• scripts/install.sh (modified) (2 diffs)
• src/server.js (modified) (2 diffs)

.env.example

@@ -1 +1 @@
 NODE_ENV=development
 PORT=3000
+
+# Network interface to bind. 127.0.0.1 = only reachable via a reverse proxy on the
+# same machine (recommended for a manual install behind Caddy/nginx — keeps the app
+# off the public internet). Use 0.0.0.0 only if you need direct external access
+# (no proxy/HTTPS — not recommended). Docker sets this to 0.0.0.0 itself.
+HOST=127.0.0.1
 # Secret used to sign login-session cookies. Leave EMPTY to auto-generate a strong
 # one on first start (saved to storage/.session-secret, stays stable across

README.md

@@ -115 +115 @@
 ```
 
+By default the app binds to `127.0.0.1` (via `HOST` in `.env`), so only your
+reverse proxy can reach it — not the open internet. Local testing on the same
+machine (`localhost:3000`) still works. Only set `HOST=0.0.0.0` if you need direct
+external access without a proxy (then open the port in your firewall and add HTTPS
+yourself).
+
 (`cwebp` is optional — `apt install webp` — for WebP image conversion.)
 

docker-compose.yml

@@ -16 +16 @@
     env_file: .env
     environment:
-      # In de container draait 'ie altijd op 3000 en in productie-modus,
-      # ongeacht wat er in .env staat.
+      # Inside the container it always runs on port 3000 in production mode and
+      # binds all interfaces (so the port mapping works) — overrides .env. The
+      # loopback host-mapping below is what keeps it off the public internet.
       NODE_ENV: production
       PORT: "3000"
+      HOST: "0.0.0.0"
     ports:
-      # host:container — wijzig de host-poort (links) als 3000 al bezet is.
-      - "3000:3000"
+      # Bind the host port to loopback only — reach the app through your reverse
+      # proxy (Caddy/nginx) on this host, not directly from the internet.
+      # Change the left side if 3000 is taken, e.g. "127.0.0.1:3001:3000".
+      - "127.0.0.1:3000:3000"
     volumes:
-      # Alle data (database, geüploade media + audio) blijft hier bewaard.
+      # All data (database, uploaded media + audio) is kept here.
       - klonkt-data:/app/storage
 

scripts/install.sh

@@ -160 +160 @@
     echo "NODE_ENV=production"
     echo "PORT=${KLONKT_PORT}"
+    # Bind to loopback only: Caddy (this host) reaches it; the internet cannot
+    # hit the app directly on its port, bypassing HTTPS.
+    echo "HOST=127.0.0.1"
     echo "SESSION_SECRET=${SECRET}"
     echo "DATABASE_PATH=./storage/database.sqlite"
@@ -168 +171 @@
   } > "$ENV"
   chown "$KLONKT_USER:$KLONKT_USER" "$ENV"; chmod 600 "$ENV"
-  ok "new .env (random SESSION_SECRET)"
+  ok "new .env (random SESSION_SECRET, app bound to 127.0.0.1)"
 else
   # sync the port in an existing .env with the chosen port
   if grep -q '^PORT=' "$ENV"; then sed -i "s/^PORT=.*/PORT=${KLONKT_PORT}/" "$ENV"; fi
-  ok "kept existing .env (port synced)"
+  # harden older installs: bind to loopback if not already configured
+  grep -q '^HOST=' "$ENV" || echo "HOST=127.0.0.1" >> "$ENV"
+  ok "kept existing .env (port synced, bound to 127.0.0.1)"
 fi
 

src/server.js

@@ -87 +87 @@
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PORT = process.env.PORT || 3000;
+// Interface to bind. Default 0.0.0.0 (needed for Docker port-forwarding). Behind a
+// reverse proxy on the same host, set HOST=127.0.0.1 so the app is NOT reachable
+// directly from the internet (only via the proxy) — see README/install docs.
+const HOST = process.env.HOST || '0.0.0.0';
 const isDev = process.env.NODE_ENV !== 'production';
 
@@ -427 +431 @@
 });
 
-server.listen(PORT, () => {
+server.listen(PORT, HOST, () => {
   console.log('');
   console.log('🪶 Klonkt Beta');