43c47a0a55
Previously published "9090:9090" → Docker bound to 0.0.0.0 (all host interfaces,
including the public Hetzner IP), leaving tailscale-internal enforced only by the
VPS firewall. Now bind explicitly to the VPS Tailscale interface for
defense-in-depth: the port does not exist on the public IP at all.
- ports -> "${TAILSCALE_BIND_IP}:9090:9090"
- env.example: add TAILSCALE_BIND_IP (VPS Tailscale IP, verify via `tailscale ip -4`)
- README: deploy section — .env is mandatory; a missing .env makes Compose
silently bind 0.0.0.0 (warns, does not fail), so use --env-file and verify host_ip
Smoke: config with --env-file and with co-located .env both resolve
host_ip=100.95.58.48; with .env absent Compose warns and falls back to 0.0.0.0
(documented). .env is gitignored (global *.env rule).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
11 lines
532 B
Plaintext
11 lines
532 B
Plaintext
# fleet-prometheus has NO secrets, but it does require one host-local value for
|
|
# the Tailscale-only port bind. Copy this file to .env (gitignored) and pass it
|
|
# at deploy with --env-file services/fleet-prometheus/.env.
|
|
#
|
|
# Configuration otherwise lives entirely in prometheus.yml (secret-free by
|
|
# contract) and the compose command flags.
|
|
|
|
# Tailscale IP węzła VPS (ubuntu-4gb-hel1-1). Bind nasłuchu Prometheus
|
|
# TYLKO do mesha — nie 0.0.0.0. Zweryfikuj przy odtwarzaniu hosta: tailscale ip -4.
|
|
TAILSCALE_BIND_IP=100.95.58.48
|