homelab/docker-infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: remove hardcoded secrets, drop unneeded privileged mode, restrict internal-only ports to localhost

Browse Source 
- watchtower: move Telegram token/chat ID to .env instead of plaintext in compose
- plex: remove stale/dead PLEX_CLAIM token
- uptime-kuma: mount docker.sock read-only (only needs to read container state)
- home-assistant: drop privileged: true (no device passthrough configured)
- glances: drop privileged: true, bind dashboard port to 127.0.0.1
- couchdb, docker-registry, leafweb: bind ports to 127.0.0.1 (proxy/localhost-only access confirmed, no direct LAN clients)
This commit is contained in:
poprhythm
2026-07-20 01:49:56 +00:00
parent 362643a064
commit 2f1a988ac3
8 changed files with 6 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plex/docker-compose.yaml
-1
View File
@@ -19,7 +19,6 @@ services:
- 32414:32414/udp
environment:
- TZ=America/New_York
- PLEX_CLAIM=claim-VCuJznuC2nxFyVgAcKec
- ADVERTISE_IP=http://73.108.236.191:32400/
- NVIDIA_VISIBLE_DEVICES=all
- NVIDIA_DRIVER_CAPABILITIES=compute,video,utility