Prod compose: record the hardening running on the box since 2026-10-15 #262

2026-10-16T10:38:05Z

extant2000git commented

2026-10-16 10:38:05 +00:00

Brings docker-compose.prod.yml in line with the box: Redis password, sealed internal network, dropped capabilities and no-new-privileges, bridge on web only. Documents FN_REDIS_PASSWORD in .env.example. The deploy uses the box's own compose, so nothing running changes. Validated with docker compose config.

🤖 Generated with Claude Code

Brings docker-compose.prod.yml in line with the box: Redis password, sealed internal network, dropped capabilities and no-new-privileges, bridge on web only. Documents FN_REDIS_PASSWORD in .env.example. The deploy uses the box's own compose, so nothing running changes. Validated with docker compose config. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

extant2000git added 1 commit 2026-10-16 10:38:05 +00:00

Prod compose: record the hardening running on the box since 2026-10-15

ci / checks (pull_request) Successful in 12s

Details

ci / swift (pull_request) Successful in 8m50s

Details

ci / image (pull_request) Successful in 50s

Details

ci / deploy (pull_request) Skipped

Details

af56f810a8

The box's compose got these during the security audit and the repo copy
did not, so a rebuild from the repo would have undone them:
- Redis requires a password (FN_REDIS_PASSWORD, written to a config file
  inside the container; healthcheck via REDISCLI_AUTH); FN_REDIS_URL
  carries it.
- The internal network is internal: true, so the database and Redis have
  no route off the box. The relay reaches S3 and APNs through web.
- relay, redis and obfs4bridge drop every capability; db keeps the five its
  entrypoint needs. All four set no-new-privileges.
- obfs4bridge is on web only.

.env.example documents FN_REDIS_PASSWORD. The deploy itself uses the
box's compose, so this changes nothing that is running.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extant2000git merged commit 0886c4a415 into main

2026-10-16 10:48:19 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-relay#262