From 50cc17f33ac787f54b2117bcb94b884b829c5b97 Mon Sep 17 00:00:00 2001 From: kami Date: Fri, 31 Jul 2026 23:01:58 +0400 Subject: [PATCH] Lock down deploy/ecosystem/nginx.conf template to match the live host The template said "drop into your nginx sites" but listened on the wildcard `listen 80;` with no allow/deny ACL, unlike the actual deployed hexis.kvmx.ru config which binds only to the WireGuard (10.42.0.1) and LAN (192.168.1.104) addresses with allow/deny all. Anyone following the template as written would expose these unauthenticated admin UIs to the open internet. Bind explicitly to those two addresses and add the matching ACL block, mirroring cmd/mavweb/nginx.conf which already does this correctly. Added a comment naming both addresses as host-specific so a deploy on a different box swaps the IPs instead of reverting to `listen 80` when the bind fails. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01CGeSZxh1DCtRxmFVSYVGvJ --- deploy/ecosystem/nginx.conf | 31 ++++++++++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-) diff --git a/deploy/ecosystem/nginx.conf b/deploy/ecosystem/nginx.conf index 43b863e..a511b03 100644 --- a/deploy/ecosystem/nginx.conf +++ b/deploy/ecosystem/nginx.conf @@ -4,10 +4,23 @@ # # NOTE: hexis. previously pointed at the MCP tool — repoint that # elsewhere first (the app now owns hexis.*). +# +# 10.42.0.1 and 192.168.1.104 below are THIS BOX's WireGuard and LAN +# addresses (homesrv) — these admin UIs have no auth of their own, so the +# explicit bind + allow/deny below is what keeps them off the open internet. +# On a different box, replace both addresses with that box's wg and LAN IPs. +# Do NOT "fix" a failed bind by reverting to `listen 80` (all interfaces) — +# that removes the only access control these containers have. server { - listen 80; + listen 10.42.0.1:80; + listen 192.168.1.104:80; server_name nexus.kvmx.ru; + + allow 10.42.0.0/24; + allow 192.168.1.0/24; + deny all; + location / { proxy_pass http://127.0.0.1:9740; proxy_set_header Host $host; @@ -18,8 +31,14 @@ server { } server { - listen 80; + listen 10.42.0.1:80; + listen 192.168.1.104:80; server_name praxis.kvmx.ru; + + allow 10.42.0.0/24; + allow 192.168.1.0/24; + deny all; + location / { proxy_pass http://127.0.0.1:8989; proxy_set_header Host $host; @@ -30,8 +49,14 @@ server { } server { - listen 80; + listen 10.42.0.1:80; + listen 192.168.1.104:80; server_name hexis.kvmx.ru; + + allow 10.42.0.0/24; + allow 192.168.1.0/24; + deny all; + location / { proxy_pass http://127.0.0.1:9741; proxy_set_header Host $host;