psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

fix(dev): bind dev Postgres to loopback and reject public LAN IP #398

Closed
David wants to merge 0 commits from fix/dev-db-loopback-bind into main
pull from: fix/dev-db-loopback-bind
merge into: psa-systems:main
Conversation 1 Commits - Files changed 582 +26 -7
David commented 2026-06-28 22:46:11 +02:00
Owner
Copy link

The dev stack discovered the host br0 IPv4 in just dev and published ports to it. On this host br0 carries a public address, so postgres:postgres was exposed to the internet and compromised by the PG_MEM/"wog" Postgres botnet (rogue superuser plus RCE via a SQL system() function that downloaded a miner). This hardens the dev stack so a database can never be published off-box.

compose.dev.yml now hardcodes the Postgres host publish to 127.0.0.1. The database is reached in-network as postgres:5432; only host-side sqlx-cli uses the loopback port, so nothing external is lost.

justfile bind-IP discovery now keeps only RFC1918 (private) addresses and falls back to 127.0.0.1 with a warning when the only candidate is public, so app ports are never published on a public interface.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

The dev stack discovered the host br0 IPv4 in `just dev` and published ports to it. On this host br0 carries a public address, so postgres:postgres was exposed to the internet and compromised by the PG_MEM/"wog" Postgres botnet (rogue superuser plus RCE via a SQL system() function that downloaded a miner). This hardens the dev stack so a database can never be published off-box. compose.dev.yml now hardcodes the Postgres host publish to 127.0.0.1. The database is reached in-network as postgres:5432; only host-side sqlx-cli uses the loopback port, so nothing external is lost. justfile bind-IP discovery now keeps only RFC1918 (private) addresses and falls back to 127.0.0.1 with a warning when the only candidate is public, so app ports are never published on a public interface. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
fix(dev): bind dev Postgres to loopback and reject public LAN IP
All checks were successful
Check / fmt + clippy + compile + tests (pull_request) Successful in 1m19s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
8af5cdb018 
The dev stack discovered the host br0 IPv4 in `just dev` and published ports to it. On this host br0 carries a public address, so postgres:postgres was exposed to the internet and compromised by the PG_MEM/"wog" Postgres botnet (rogue superuser plus RCE via a SQL system() function that downloaded a miner). This hardens the dev stack so a database can never be published off-box.

compose.dev.yml now hardcodes the Postgres host publish to 127.0.0.1. The database is reached in-network as postgres:5432; only host-side sqlx-cli uses the loopback port, so nothing external is lost.

justfile bind-IP discovery now keeps only RFC1918 (private) addresses and falls back to 127.0.0.1 with a warning when the only candidate is public, so app ports are never published on a public interface.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
David commented 2026-06-28 22:55:34 +02:00
Author
Owner
Copy link

Superseded by #399. This branch no longer merged (mergeable: false): its third hunk (dropping the server -> infisical depends_on) already landed separately on main when Infisical moved behind the infisical compose profile, and the branch was based on a long-superseded main. #399 re-applies the two still-needed security hunks (hardcode Postgres host publish to 127.0.0.1; RFC1918-only LAN-IP discovery with loopback fallback) cleanly onto current main. Closing in favor of #399.

Superseded by #399. This branch no longer merged (`mergeable: false`): its third hunk (dropping the `server` -> `infisical` `depends_on`) already landed separately on `main` when Infisical moved behind the `infisical` compose profile, and the branch was based on a long-superseded `main`. #399 re-applies the two still-needed security hunks (hardcode Postgres host publish to `127.0.0.1`; RFC1918-only LAN-IP discovery with loopback fallback) cleanly onto current `main`. Closing in favor of #399.
David closed this pull request 2026-06-28 22:55:34 +02:00
David deleted branch fix/dev-db-loopback-bind 2026-06-28 22:56:42 +02:00
Some checks are pending
Check / fmt + clippy + compile + tests (pull_request) Successful in 1m19s
Required
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
E2E / * (pull_request)
Required

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!398
No description provided.