From 68fe786f21b1892768f018650ac0a681492de35c Mon Sep 17 00:00:00 2001 From: Indra Gunawan <1284811+coderbuzz@users.noreply.github.com> Date: Thu, 15 Oct 2026 16:28:31 +0700 Subject: [PATCH] docs: note that the controller now binds 127.0.0.1 and why Co-Authored-By: Claude Fable 5.1 --- audits/DOCKIFY-AUDIT-FABLE-5.1.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/audits/DOCKIFY-AUDIT-FABLE-5.1.md b/audits/DOCKIFY-AUDIT-FABLE-5.1.md index 3555e29..3bd5137 100644 --- a/audits/DOCKIFY-AUDIT-FABLE-5.1.md +++ b/audits/DOCKIFY-AUDIT-FABLE-5.1.md @@ -696,7 +696,7 @@ Code by Claude Opus 5.5 sessions, review and merge by Fable 5.1. Final `main`: ### Release 0.7.0 — done 2026-10-15 16:02 WIB - Tag `v0.7.0` on `b4d17dd`; CI published `dockify-linux-amd64` + `.sha256`. -- Controller: service stopped, DB snapshot taken (205 MB, `user_version` 0, integrity ok), `update.sh` verified the checksum and installed the binary; migration 0 → 4 took 21 s (32 duplicate route rows removed, 0 FK violations); health 200, UI through Caddy 200, 26 apps / 24 running, both workers' host keys pinned and their SHA256 fingerprints match the ones observed independently from the operator's machine. `DOCKIFY_TRUST_PROXY=true` added to `/opt/dockify/.env`. `DOCKIFY_HOST=127.0.0.1` was **not** applied: an external client still connects to port 8080 directly; check what it is before closing the port. +- Controller: service stopped, DB snapshot taken (205 MB, `user_version` 0, integrity ok), `update.sh` verified the checksum and installed the binary; migration 0 → 4 took 21 s (32 duplicate route rows removed, 0 FK violations); health 200, UI through Caddy 200, 26 apps / 24 running, both workers' host keys pinned and their SHA256 fingerprints match the ones observed independently from the operator's machine. `DOCKIFY_TRUST_PROXY=true` added to `/opt/dockify/.env`. `DOCKIFY_HOST=127.0.0.1` was applied at 16:27 WIB after confirming that every real request and every GitHub webhook arrives through `dockify.amg.id` and that the only direct hits on `51.79.130.131:8080` were internet scanners (651 in 24 h, no login attempts; the VM has no firewall at all): port 8080 now refuses external connections, the domain and the webhook route still answer. A host firewall (22/80/443 only) is still recommended as a second layer; `install.sh` should default `DOCKIFY_HOST` to loopback in the next release. - Verification redeploy of `kv-dev.amg.id` (staging): success in 3 s, container env byte-identical to before (8 vars), `.env` now 0600 and quoted, Caddy routes persisted on disk (7/7), HTTPS unchanged. - Rollback (one command, as root on the controller): `sudo /opt/dockify/rollback/rollback.sh` restores the 0.6.22 binary, the pre-update DB snapshot and the original `.env`, and keeps the 0.7.0 database aside. Delete `/opt/dockify/rollback` (≈220 MB) once 0.7.0 has run for a few days. - Still open after the release: delete the dead server `production-1` from the UI (now possible); optionally remove `~/.ssh/dockify*` on both workers; B14/B11 and the Settings-page self-update (`systemd-run`) remain unexercised on the real hosts.