Port 8080 shouldn't be exposed publicly

samsapti commented

2022-11-16 13:19:12 +00:00

Owner

a03263b1f5

nginx-proxy should be able to communicate with riot through the external_services Docker network. If that's not the case, the port exposure should be specified as

ports:
  - "127.0.0.1:8080:8080"

such that it can't be accessed from outside the server.

Ping: @reynir

https://git.data.coop/data.coop/ansible/commit/a03263b1f5e06aa56f9f68db6695efd58f02481c nginx-proxy should be able to communicate with riot through the `external_services` Docker network. If that's not the case, the port exposure should be specified as ```yaml ports: - "127.0.0.1:8080:8080" ``` such that it can't be accessed from outside the server. Ping: @reynir

samsapti added the

Infrastructure Issue

label 2022-11-16 13:26:16 +00:00

samsapti added

Security Hardening

and removed

Infrastructure Issue

labels 2022-11-16 13:32:56 +00:00

reynir commented

2022-11-16 13:35:03 +00:00

Owner

expose doesn't expose the port publicly. It's like writing EXPOSE 8080 in the Dockerfile. It is not the same as ports which publicly exposes the port(s) on the host.

[`expose`](https://docs.ansible.com/ansible/latest/collections/community/docker/docker_container_module.html#parameter-exposed_ports) doesn't expose the port publicly. It's like writing `EXPOSE 8080` in the Dockerfile. It is not the same as [`ports`](https://docs.ansible.com/ansible/latest/collections/community/docker/docker_container_module.html#parameter-published_ports) which publicly exposes the port(s) on the host.

👍 1

reynir closed this issue

2022-11-16 13:35:04 +00:00

reynir commented

2022-11-16 13:35:50 +00:00

Owner

It can also be confirmed on our host:

reynir@hevonen:~$ sudo netstat -tlnp | grep 8080
reynir@hevonen:~$

It can also be confirmed on our host: ```shell reynir@hevonen:~$ sudo netstat -tlnp | grep 8080 reynir@hevonen:~$ ```

👍 1

samsapti commented

2022-11-16 13:36:07 +00:00

Author

Owner

Ah, in that case I learned something new today :D

samsapti removed the

Security Hardening

label 2022-11-16 13:37:05 +00:00

samsapti commented

2022-11-16 13:37:32 +00:00

Author

Owner

But how come nginx can't infer that from VIRTUAL_PORT? Seems a bit weird.

But how come nginx can't infer that from `VIRTUAL_PORT`? Seems a bit weird.

reynir commented

2022-11-16 13:37:34 +00:00

Owner

The EXPOSE is necessary because it tells docker (and thus nginx-proxy) what ports the container is listening on. Nginx-proxy will otherwise treat the container as being down resulting in annoying 503s :(

The EXPOSE is necessary because it tells docker (and thus nginx-proxy) what ports the container is listening on. Nginx-proxy will otherwise treat the container as being down resulting in annoying 503s :( See also https://github.com/nginx-proxy/nginx-proxy/issues/1132

samsapti commented

2022-11-16 13:39:30 +00:00

Author

Owner

See also https://github.com/nginx-proxy/nginx-proxy/issues/1132

It looks like it should have been fixed by https://github.com/nginx-proxy/nginx-proxy/pull/1609, no?

> See also https://github.com/nginx-proxy/nginx-proxy/issues/1132 It looks like it should have been fixed by https://github.com/nginx-proxy/nginx-proxy/pull/1609, no?

reynir commented

2022-11-16 13:41:45 +00:00

Owner

Maybe. That issue was not exactly about this, but it's there I learned about nginx-proxy and its expectations about EXPOSE.

Maybe. That issue was not exactly about this, but it's there I learned about nginx-proxy and its expectations about `EXPOSE`.

👍 1

reynir commented

2022-11-16 13:42:25 +00:00

Owner

And besides, adding expose: 8080 made element.data.coop work again...

And besides, adding `expose: 8080` made element.data.coop work again...

👍 1