homelab/docker-infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: remove hardcoded secrets, drop unneeded privileged mode, restrict internal-only ports to localhost

Browse Source 
- watchtower: move Telegram token/chat ID to .env instead of plaintext in compose
- plex: remove stale/dead PLEX_CLAIM token
- uptime-kuma: mount docker.sock read-only (only needs to read container state)
- home-assistant: drop privileged: true (no device passthrough configured)
- glances: drop privileged: true, bind dashboard port to 127.0.0.1
- couchdb, docker-registry, leafweb: bind ports to 127.0.0.1 (proxy/localhost-only access confirmed, no direct LAN clients)
This commit is contained in:
poprhythm
2026-07-20 01:49:56 +00:00
parent 362643a064
commit 2f1a988ac3
8 changed files with 6 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
couchdb/docker-compose.yml
+1 -1
View File
@@ -4,7 +4,7 @@ services:
container_name: couchdb container_name: couchdb
restart: always restart: always
ports: ports:
- "5984:5984" - "127.0.0.1:5984:5984"
environment: environment:
- COUCHDB_USER=admin - COUCHDB_USER=admin
- COUCHDB_PASSWORD=${ADMIN_PASSWORD} - COUCHDB_PASSWORD=${ADMIN_PASSWORD}
docker-registry/docker-compose.yaml
+1 -1
View File
@@ -40,4 +40,4 @@ services:
- /srv/registry/data:/data - /srv/registry/data:/data
- /srv/registry/registry.password:/auth/registry.password - /srv/registry/registry.password:/auth/registry.password
ports: ports:
- 5000 - 127.0.0.1:5000:5000
glances/docker-compose.yaml
+1 -2
View File
@@ -3,9 +3,8 @@ services:
container_name: glances container_name: glances
image: 'nicolargo/glances:ubuntu-latest-full' image: 'nicolargo/glances:ubuntu-latest-full'
restart: unless-stopped restart: unless-stopped
privileged: true
ports: ports:
- 61208-61209:61208-61209 - 127.0.0.1:61208-61209:61208-61209
environment: environment:
- TZ=${TZ} - TZ=${TZ}
- NVIDIA_VISIBLE_DEVICES=all - NVIDIA_VISIBLE_DEVICES=all
home-assistant/docker-compose.yml
-1
View File
@@ -18,4 +18,3 @@ services:
- VIRTUAL_PORT=8123 - VIRTUAL_PORT=8123
- LETSENCRYPT_HOST=homeassistant.kolpacksoftware.com - LETSENCRYPT_HOST=homeassistant.kolpacksoftware.com
restart: unless-stopped restart: unless-stopped
privileged: true
leafweb/docker-compose.yml
+1 -1
View File
@@ -7,4 +7,4 @@ services:
SA_PASSWORD: ${SA_PASSWORD} SA_PASSWORD: ${SA_PASSWORD}
ACCEPT_EULA: Y ACCEPT_EULA: Y
ports: ports:
- "1433:1433" - "127.0.0.1:1433:1433"
plex/docker-compose.yaml
-1
View File
@@ -19,7 +19,6 @@ services:
- 32414:32414/udp - 32414:32414/udp
environment: environment:
- TZ=America/New_York - TZ=America/New_York
- PLEX_CLAIM=claim-VCuJznuC2nxFyVgAcKec
- ADVERTISE_IP=http://73.108.236.191:32400/ - ADVERTISE_IP=http://73.108.236.191:32400/
- NVIDIA_VISIBLE_DEVICES=all - NVIDIA_VISIBLE_DEVICES=all
- NVIDIA_DRIVER_CAPABILITIES=compute,video,utility - NVIDIA_DRIVER_CAPABILITIES=compute,video,utility
uptime-kuma/docker-compose.yaml
+1 -1
View File
@@ -5,7 +5,7 @@ services:
restart: unless-stopped restart: unless-stopped
volumes: volumes:
- /srv/uptime-kuma/data:/app/data - /srv/uptime-kuma/data:/app/data
- /var/run/docker.sock:/var/run/docker.sock - /var/run/docker.sock:/var/run/docker.sock:ro
environment: environment:
- TZ=America/New_York - TZ=America/New_York
- VIRTUAL_HOST=uptime.kolpacksoftware.com - VIRTUAL_HOST=uptime.kolpacksoftware.com
watchtower/docker-compose.yml
+1 -1
View File
@@ -8,7 +8,7 @@ services:
environment: environment:
- WATCHTOWER_POLL_INTERVAL=300 - WATCHTOWER_POLL_INTERVAL=300
- WATCHTOWER_CLEANUP=true - WATCHTOWER_CLEANUP=true
- WATCHTOWER_NOTIFICATION_URL=telegram://8585007357:AAHtiEFm30Mpg6zl_1hww-BAWPXWu9GsDB0@telegram?chats=8444709468 - WATCHTOWER_NOTIFICATION_URL=telegram://${TELEGRAM_BOT_TOKEN}@telegram?chats=${TELEGRAM_CHAT_ID}
labels: labels:
- com.centurylinklabs.watchtower.enable=false - com.centurylinklabs.watchtower.enable=false
restart: unless-stopped restart: unless-stopped