kami
50cc17f33a
The template said "drop into your nginx sites" but listened on the wildcard `listen 80;` with no allow/deny ACL, unlike the actual deployed hexis.kvmx.ru config which binds only to the WireGuard (10.42.0.1) and LAN (192.168.1.104) addresses with allow/deny all. Anyone following the template as written would expose these unauthenticated admin UIs to the open internet. Bind explicitly to those two addresses and add the matching ACL block, mirroring cmd/mavweb/nginx.conf which already does this correctly. Added a comment naming both addresses as host-specific so a deploy on a different box swaps the IPs instead of reverting to `listen 80` when the bind fails. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CGeSZxh1DCtRxmFVSYVGvJ
68 lines
2.1 KiB
Nginx Configuration File
68 lines
2.1 KiB
Nginx Configuration File
# Reverse-proxy the three sibling admin UIs. Drop into your nginx sites (or the
|
|
# nginx-panel app) and reload. Assumes the compose publishes each service on
|
|
# 127.0.0.1:<port>. Add TLS (certbot / your existing cert block) per server.
|
|
#
|
|
# NOTE: hexis.<domain> previously pointed at the MCP tool — repoint that
|
|
# elsewhere first (the app now owns hexis.*).
|
|
#
|
|
# 10.42.0.1 and 192.168.1.104 below are THIS BOX's WireGuard and LAN
|
|
# addresses (homesrv) — these admin UIs have no auth of their own, so the
|
|
# explicit bind + allow/deny below is what keeps them off the open internet.
|
|
# On a different box, replace both addresses with that box's wg and LAN IPs.
|
|
# Do NOT "fix" a failed bind by reverting to `listen 80` (all interfaces) —
|
|
# that removes the only access control these containers have.
|
|
|
|
server {
|
|
listen 10.42.0.1:80;
|
|
listen 192.168.1.104:80;
|
|
server_name nexus.kvmx.ru;
|
|
|
|
allow 10.42.0.0/24;
|
|
allow 192.168.1.0/24;
|
|
deny all;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:9740;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 10.42.0.1:80;
|
|
listen 192.168.1.104:80;
|
|
server_name praxis.kvmx.ru;
|
|
|
|
allow 10.42.0.0/24;
|
|
allow 192.168.1.0/24;
|
|
deny all;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:8989;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 10.42.0.1:80;
|
|
listen 192.168.1.104:80;
|
|
server_name hexis.kvmx.ru;
|
|
|
|
allow 10.42.0.0/24;
|
|
allow 192.168.1.0/24;
|
|
deny all;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:9741;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|