fix(dev): bind dev Postgres to loopback and reject public LAN IP #399
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/dev-db-loopback-bind-on-main"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Re-applies the security hunks from the stale #398 onto current
main. PR #398 no longer merged (mergeable: false): its third hunk (dropping theserver->infisicaldepends_on) already landed separately on main when Infisical moved behind theinfisicalcompose profile, and its branch was based on a long-supersededmain. Main is still vulnerable on the two security hunks until this lands.The dev stack discovered the host br0 IPv4 in
just devand published ports to it. On some hosts br0 carries a public address, sopostgres:postgreswas exposed to the internet and compromised by the PG_MEM/"wog" Postgres botnet (rogue superuser plus RCE via a SQLsystem()function that downloaded a miner). This hardens the dev stack so a database can never be published off-box.compose.dev.ymlnow hardcodes the Postgres host publish to127.0.0.1(never${MOKOSH_HOST_BIND_IP}). The database is reached in-network aspostgres:5432; only host-side sqlx-cli uses the loopback port, so nothing external is lost.justfilebind-IP discovery now keeps only RFC1918 (private) addresses (10/8,172.16-31/12,192.168/16) and falls back to127.0.0.1with a warning when the only candidate is public, so app ports are never published on a public interface.Verification:
docker compose -f compose.dev.yml configvalidates and renders the Postgres publish ashost_ip: 127.0.0.1(127.0.0.1:5433->5432);just --listparses the justfile; the RFC1918 filter was unit-tested against public, link-local, and the 172.15/172.32 boundary addresses; the localjust pre-commithook passed on commit.Supersedes #398, which should be closed.
🤖 Generated with Claude Code
compose.dev.yml now hardcodes the Postgres host publish to 127.0.0.1 instead of ${MOKOSH_HOST_BIND_IP}. The database is reached in-network as postgres:5432; only host-side sqlx-cli uses the loopback port, so nothing external is lost. A prior LAN-IP bind put postgres:postgres on a public interface where it was compromised by the PG_MEM/"wog" botnet (rogue superuser plus RCE via a SQL system() function that downloaded a miner). justfile bind-IP discovery in `just dev` now keeps only RFC1918 (private) addresses and falls back to 127.0.0.1 with a warning when the only candidate is public, so app host ports are never published on a public interface. Containers still reach each other over the Docker network regardless. Re-applies the security hunks from the stale PR #398 onto current main; that branch no longer merged because its third hunk (dropping the server->infisical depends_on) already landed separately when Infisical moved behind a compose profile. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>