fix(dev): bind app Postgres to loopback and fail loud on missing DB secrets (PMS-496) #392
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/PMS-496-postgres-loopback-bind-fail-loud-secrets"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The dev Postgres published its host port at ${MOKOSH_HOST_BIND_IP}:${MOKOSH_PG_HOST_PORT}:5432. just dev derives MOKOSH_HOST_BIND_IP from the first non-loopback interface (br0/eth0), which can be the public edge, so the application database - and the BYPASSRLS mokosh_migrator role reachable through it - was published to the LAN/internet. The DB passwords also silently defaulted to postgres / mokosh_migrator_dev / mokosh_app_dev when unset.
Publish the postgres host port on 127.0.0.1 only. Host-side sqlx-cli (just migrate-run) reaches it via localhost:${MOKOSH_PG_HOST_PORT}; sibling containers use in-network DNS postgres:5432 and need no host publish. MOKOSH_HOST_BIND_IP is no longer used for any host port (it stays for the server BASE_URL). This also keeps the migrator role off every non-loopback interface.
Drop all DB password defaults (MOKOSH_PG_PASSWORD, MOKOSH_MIGRATOR_PASSWORD, MOKOSH_APP_PASSWORD and the postgres:// URLs derived from them) to the ${VAR:?} fail-loud form. just ensure-env (PMS-490) already generates per-host secrets into .env, so an unset value now stops the stack with a helpful message instead of booting with weak credentials.
#PMS-496
The dev Postgres published its host port at ${MOKOSH_HOST_BIND_IP}:${MOKOSH_PG_HOST_PORT}:5432. just dev derives MOKOSH_HOST_BIND_IP from the first non-loopback interface (br0/eth0), which can be the public edge, so the application database - and the BYPASSRLS mokosh_migrator role reachable through it - was published to the LAN/internet. The DB passwords also silently defaulted to postgres / mokosh_migrator_dev / mokosh_app_dev when unset. Publish the postgres host port on 127.0.0.1 only. Host-side sqlx-cli (just migrate-run) reaches it via localhost:${MOKOSH_PG_HOST_PORT}; sibling containers use in-network DNS postgres:5432 and need no host publish. MOKOSH_HOST_BIND_IP is no longer used for any host port (it stays for the server BASE_URL). This also keeps the migrator role off every non-loopback interface. Drop all DB password defaults (MOKOSH_PG_PASSWORD, MOKOSH_MIGRATOR_PASSWORD, MOKOSH_APP_PASSWORD and the postgres:// URLs derived from them) to the ${VAR:?} fail-loud form. just ensure-env (PMS-490) already generates per-host secrets into .env, so an unset value now stops the stack with a helpful message instead of booting with weak credentials. #PMS-496