archetech / archon / 34786526960

92%

main: 87%

Pull #1139

github

fix(compose): Bind the admin UIs to loopback by default

RTL, Grafana, and the LNbits admin UI published with a short PORT:PORT
form, which binds 0.0.0.0. Docker inserts its publish rules ahead of the
host firewall, so an operator whose UFW allows only 22/80/443 still had
three admin UIs on the public internet -- a credential-stuffing flood
against RTL on 4tress.org is what surfaced it (#1138).

Each now binds 127.0.0.1 by default with an ARCHON_*_BIND override, so a
reverse proxy or SSH tunnel works unchanged and public exposure is a
deliberate 0.0.0.0. LNbits was not in the report and is the worst of the
three -- it is the custodial wallet backend with LNBITS_ADMIN_UI=true.

Scope is the admin UIs only. The user-facing UIs (explorer, react-wallet,
the *-client apps) publish on 0.0.0.0 too, but they are meant to be
reached and defaulting them to loopback is a behaviour change; the
in-network API ports (gatekeeper, lightning-mediator) are a separate
question. Both left for a deliberate pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GYGMfX3foBcVqP7AQNXjWj

4168 of 4792 branches covered (86.98%)

Branch coverage included in aggregate %.

8808 of 9246 relevant lines covered (95.26%)

773.51 hits per line