hueta

services/rusgram/docker-compose.yml

@@ -6,12 +6,15 @@ services:
     ports:
       - "38000:5000"
 
+  # Внутренние ноды НЕ публикуем на хост вообще.
+  # Атака #244475: GET :38002/images/16 без auth → флаги из comments.
+  # Даже 127.0.0.1:38002 опасно, если на боксе крутят туннели/агентов.
   static:
     build: ./static
     image: git.itqdev.xyz/4x10m/rusgram-static:${IMAGE_TAG:-latest}
     restart: unless-stopped
-    ports:
-      - "127.0.0.1:38001:5001"
+    expose:
+      - "5001"
     volumes:
       - "./website:/app/files"
 
@@ -19,8 +22,10 @@ services:
     build: ./database
     image: git.itqdev.xyz/4x10m/rusgram-database:${IMAGE_TAG:-latest}
     restart: unless-stopped
-    ports:
-      - "127.0.0.1:38002:5002"
+    environment:
+      RUSGRAM_INTERNAL: "e9b2f6d14a8c7035e1d0a6b8c4f2e7a9"
+    expose:
+      - "5002"
     volumes:
       - "./website:/app/files"
 
@@ -28,14 +33,18 @@ services:
     build: ./logic
     image: git.itqdev.xyz/4x10m/rusgram-logic:${IMAGE_TAG:-latest}
     restart: unless-stopped
-    ports:
-      - "127.0.0.1:38003:5003"
+    environment:
+      RUSGRAM_INTERNAL: "e9b2f6d14a8c7035e1d0a6b8c4f2e7a9"
+    expose:
+      - "5003"
 
   content:
     build: ./content
     image: git.itqdev.xyz/4x10m/rusgram-content:${IMAGE_TAG:-latest}
     restart: unless-stopped
-    ports:
-      - "127.0.0.1:38004:5004"
+    environment:
+      RUSGRAM_INTERNAL: "e9b2f6d14a8c7035e1d0a6b8c4f2e7a9"
+    expose:
+      - "5004"
     volumes:
       - "./website:/app/files"