extant2000/flamenet-relay
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

Prod compose: record the hardening running on the box since 2026-10-15 #262

Merged
extant2000git merged 1 commits from chore/record-box-hardening into main 2026-10-16 10:48:19 +00:00
Conversation 0 Commits 1 Files Changed 2
+35 -4
1 Commits
Author SHA1 Message Date
Paul HittandClaude Opus 5.5 af56f810a8 Prod compose: record the hardening running on the box since 2026-10-15
ci / checks (pull_request) Successful in 12s
Details
ci / swift (pull_request) Successful in 8m50s
Details
ci / image (pull_request) Successful in 50s
Details
ci / deploy (pull_request) Skipped
Details 
The box's compose got these during the security audit and the repo copy
did not, so a rebuild from the repo would have undone them:
- Redis requires a password (FN_REDIS_PASSWORD, written to a config file
  inside the container; healthcheck via REDISCLI_AUTH); FN_REDIS_URL
  carries it.
- The internal network is internal: true, so the database and Redis have
  no route off the box. The relay reaches S3 and APNs through web.
- relay, redis and obfs4bridge drop every capability; db keeps the five its
  entrypoint needs. All four set no-new-privileges.
- obfs4bridge is on web only.

.env.example documents FN_REDIS_PASSWORD. The deploy itself uses the
box's compose, so this changes nothing that is running.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-16 06:38:04 -04:00