Changeset f99bbe8 in Klonkt for scripts

Timestamp:

06/23/2026 10:00:00 PM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

5eef817

Parents:

09ee2bd

Message:

security: bind to 127.0.0.1 by default behind a reverse proxy

New HOST env (default 0.0.0.0 for Docker/back-compat). The VPS installer now
writes HOST=127.0.0.1 and Docker maps the host port to loopback (127.0.0.1:3000:3000)
+ overrides HOST=0.0.0.0 inside the container — so the app is never reachable
directly on its port from the internet, only via the proxy. .env.example defaults
to 127.0.0.1 (manual installs); docs explain it. Existing installs hardened on
re-run of install.sh.

Co-Authored-By: Claude <noreply@…>

File:

• scripts/install.sh (modified) (2 diffs)

scripts/install.sh

@@ -160 +160 @@
     echo "NODE_ENV=production"
     echo "PORT=${KLONKT_PORT}"
+    # Bind to loopback only: Caddy (this host) reaches it; the internet cannot
+    # hit the app directly on its port, bypassing HTTPS.
+    echo "HOST=127.0.0.1"
     echo "SESSION_SECRET=${SECRET}"
     echo "DATABASE_PATH=./storage/database.sqlite"
@@ -168 +171 @@
   } > "$ENV"
   chown "$KLONKT_USER:$KLONKT_USER" "$ENV"; chmod 600 "$ENV"
-  ok "new .env (random SESSION_SECRET)"
+  ok "new .env (random SESSION_SECRET, app bound to 127.0.0.1)"
 else
   # sync the port in an existing .env with the chosen port
   if grep -q '^PORT=' "$ENV"; then sed -i "s/^PORT=.*/PORT=${KLONKT_PORT}/" "$ENV"; fi
-  ok "kept existing .env (port synced)"
+  # harden older installs: bind to loopback if not already configured
+  grep -q '^HOST=' "$ENV" || echo "HOST=127.0.0.1" >> "$ENV"
+  ok "kept existing .env (port synced, bound to 127.0.0.1)"
 fi