Harden Docker compose gateway exposure#186
Merged
bglusman merged 3 commits intoMay 12, 2026
Merged
Conversation
ⓘ You've reached your Qodo monthly free-tier limit. Reviews pause until next month — upgrade your plan to continue now, or link your paid account if you already have one. |
There was a problem hiding this comment.
Pull request overview
Hardens the Docker Compose packaging example to avoid exposing unauthenticated Calciforge gateway and sidecar ports on all host interfaces by default, and to require a client-facing gateway API key in the example config.
Changes:
- Default Compose published ports to loopback via
${CALCIFORGE_HOST_BIND:-127.0.0.1}forcalciforge,security-proxy, andclashd. - Require a gateway bearer token in the Docker example config via
proxy.api_key_file. - Add docs + packaging guardrails for key provisioning and loopback-first behavior.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| scripts/check-packaging.sh | Adds packaging assertions for loopback-default port publishing, required gateway API key file, and README key provisioning. |
| packaging/docker/README.md | Documents loopback-default bindings and adds steps to generate and chmod the gateway API key file. |
| packaging/docker/docker-compose.yml | Changes published port mappings to default-bind to loopback unless overridden by CALCIFORGE_HOST_BIND. |
| packaging/docker/config.example.toml | Adds proxy.api_key_file so the example gateway runs authenticated. |
| packaging/docker/calciforge.env.example | Introduces CALCIFORGE_HOST_BIND=127.0.0.1 and guidance for intentional LAN exposure. |
Comment on lines
+61
to
+64
| grep -q 'CALCIFORGE_HOST_BIND:-127.0.0.1' "$ROOT/packaging/docker/docker-compose.yml" || { | ||
| echo "Docker Compose published ports must default to loopback host binding" >&2 | ||
| exit 1 | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Description
CALCIFORGE_HOST_BINDand using${CALCIFORGE_HOST_BIND:-127.0.0.1}inpackaging/docker/docker-compose.ymlforcalciforge,security-proxy, andclashdport mappings.api_key_file = "/var/lib/calciforge/gateway-api-key"topackaging/docker/config.example.tomlso the example gateway does not run unauthenticated.packaging/docker/README.mdand setCALCIFORGE_HOST_BIND=127.0.0.1inpackaging/docker/calciforge.env.example, including instructions to createdata/gateway-api-keyand guidance for intentional LAN exposure.scripts/check-packaging.shto assert the Compose sample defaults to loopback bindings, requires theapi_key_fileentry, and provisions the sample gateway key in the README.Testing
bash scripts/check-packaging.sh, which passed (packaging checks exercised the new assertions).cargo fmt --all -- --checkandbash -n scripts/check-packaging.sh, both of which passed locally.git diff --checkwhich reported no check failures andgitleakswas skipped as it is not installed in the environment.cargo test -p calciforge test_channel_docs, which failed due to an unrelated existing-D dead-codeerror incrates/calciforge/src/context.rsand not because of these packaging changes.Codex Task