Skip to content

docs: controller now binds loopback; scanner traffic on 8080 explained #95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
coderbuzz merged 1 commit into from
Oct 15, 2026
Merged

docs: controller now binds loopback; scanner traffic on 8080 explained #95

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion audits/DOCKIFY-AUDIT-FABLE-5.1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -696,7 +696,7 @@ Code by Claude Opus 5.5 sessions, review and merge by Fable 5.1. Final `main`:
### Release 0.7.0 — done 2026-10-15 16:02 WIB

- Tag `v0.7.0` on `b4d17dd`; CI published `dockify-linux-amd64` + `.sha256`.
- Controller: service stopped, DB snapshot taken (205 MB, `user_version` 0, integrity ok), `update.sh` verified the checksum and installed the binary; migration 0 → 4 took 21 s (32 duplicate route rows removed, 0 FK violations); health 200, UI through Caddy 200, 26 apps / 24 running, both workers' host keys pinned and their SHA256 fingerprints match the ones observed independently from the operator's machine. `DOCKIFY_TRUST_PROXY=true` added to `/opt/dockify/.env`. `DOCKIFY_HOST=127.0.0.1` was **not** applied: an external client still connects to port 8080 directly; check what it is before closing the port.
- Controller: service stopped, DB snapshot taken (205 MB, `user_version` 0, integrity ok), `update.sh` verified the checksum and installed the binary; migration 0 → 4 took 21 s (32 duplicate route rows removed, 0 FK violations); health 200, UI through Caddy 200, 26 apps / 24 running, both workers' host keys pinned and their SHA256 fingerprints match the ones observed independently from the operator's machine. `DOCKIFY_TRUST_PROXY=true` added to `/opt/dockify/.env`. `DOCKIFY_HOST=127.0.0.1` was applied at 16:27 WIB after confirming that every real request and every GitHub webhook arrives through `dockify.amg.id` and that the only direct hits on `51.79.130.131:8080` were internet scanners (651 in 24 h, no login attempts; the VM has no firewall at all): port 8080 now refuses external connections, the domain and the webhook route still answer. A host firewall (22/80/443 only) is still recommended as a second layer; `install.sh` should default `DOCKIFY_HOST` to loopback in the next release.
- Verification redeploy of `kv-dev.amg.id` (staging): success in 3 s, container env byte-identical to before (8 vars), `.env` now 0600 and quoted, Caddy routes persisted on disk (7/7), HTTPS unchanged.
- Rollback (one command, as root on the controller): `sudo /opt/dockify/rollback/rollback.sh` restores the 0.6.22 binary, the pre-update DB snapshot and the original `.env`, and keeps the 0.7.0 database aside. Delete `/opt/dockify/rollback` (≈220 MB) once 0.7.0 has run for a few days.
- Still open after the release: delete the dead server `production-1` from the UI (now possible); optionally remove `~/.ssh/dockify*` on both workers; B14/B11 and the Settings-page self-update (`systemd-run`) remain unexercised on the real hosts.
Expand Down
Loading