43c47a0a55
Previously published "9090:9090" → Docker bound to 0.0.0.0 (all host interfaces,
including the public Hetzner IP), leaving tailscale-internal enforced only by the
VPS firewall. Now bind explicitly to the VPS Tailscale interface for
defense-in-depth: the port does not exist on the public IP at all.
- ports -> "${TAILSCALE_BIND_IP}:9090:9090"
- env.example: add TAILSCALE_BIND_IP (VPS Tailscale IP, verify via `tailscale ip -4`)
- README: deploy section — .env is mandatory; a missing .env makes Compose
silently bind 0.0.0.0 (warns, does not fail), so use --env-file and verify host_ip
Smoke: config with --env-file and with co-located .env both resolve
host_ip=100.95.58.48; with .env absent Compose warns and falls back to 0.0.0.0
(documented). .env is gitignored (global *.env rule).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| agent-system | ||
| brain-watchdog | ||
| control-plane | ||
| fleet-prometheus | ||
| forgejo | ||
| ha-diag-agent | ||
| kb-postgres | ||
| mosquitto | ||
| node-agent | ||
| node_exporter | ||
| npm | ||
| ollama | ||
| planner-agent | ||
| stability-agent | ||
| vikunja | ||
| zigbee2mqtt | ||
| .gitkeep | ||