fix(security): enforce mandatory HUB_SECRET, loopback-only 127.0.0.1 binding, cookie Path rewriting per universe

2026-08-19 21:47:15 +01:00
parent b61f1804b9
commit 4923aa380e
5 changed files with 75 additions and 28 deletions
@@ -7,12 +7,14 @@ services:
    restart: unless-stopped
    user: "1026:100"
    ports:
-      - "8080:8080"
+      # Bind strictement sur loopback pour n'etre accessible QUE par Cloudflare Tunnel / Tailscale
+      - "127.0.0.1:8080:8080"
    volumes:
      - ./data:/app/data
    environment:
      - TZ=Africa/Tunis
      - HUB_DATA_DIR=/app/data
+      - HUB_SECRET=${HUB_SECRET}
      - NAS_TAILSCALE_IP=100.86.197.88
      - VPS_TAILSCALE_IP=100.94.90.119
      - HERMES_TT_URL=http://100.86.197.88:3010