Changeset f99bbe8 in Klonkt for docker-compose.yml

Timestamp:

06/23/2026 10:00:00 PM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

5eef817

Parents:

09ee2bd

Message:

security: bind to 127.0.0.1 by default behind a reverse proxy

New HOST env (default 0.0.0.0 for Docker/back-compat). The VPS installer now
writes HOST=127.0.0.1 and Docker maps the host port to loopback (127.0.0.1:3000:3000)
+ overrides HOST=0.0.0.0 inside the container — so the app is never reachable
directly on its port from the internet, only via the proxy. .env.example defaults
to 127.0.0.1 (manual installs); docs explain it. Existing installs hardened on
re-run of install.sh.

Co-Authored-By: Claude <noreply@…>

File:

• docker-compose.yml (modified) (1 diff)

docker-compose.yml

@@ -16 +16 @@
     env_file: .env
     environment:
-      # In de container draait 'ie altijd op 3000 en in productie-modus,
-      # ongeacht wat er in .env staat.
+      # Inside the container it always runs on port 3000 in production mode and
+      # binds all interfaces (so the port mapping works) — overrides .env. The
+      # loopback host-mapping below is what keeps it off the public internet.
       NODE_ENV: production
       PORT: "3000"
+      HOST: "0.0.0.0"
     ports:
-      # host:container — wijzig de host-poort (links) als 3000 al bezet is.
-      - "3000:3000"
+      # Bind the host port to loopback only — reach the app through your reverse
+      # proxy (Caddy/nginx) on this host, not directly from the internet.
+      # Change the left side if 3000 is taken, e.g. "127.0.0.1:3001:3000".
+      - "127.0.0.1:3000:3000"
     volumes:
-      # Alle data (database, geüploade media + audio) blijft hier bewaard.
+      # All data (database, uploaded media + audio) is kept here.
       - klonkt-data:/app/storage