#37 Hardening by virtual LAN & avoid host port binding

Fusionado
tunefish fusionados 1 commits de hostbbq/sec/net-ip-port en hostbbq/master hace 8 meses
Se han modificado 2 ficheros con 23 adiciones y 1 borrados
  1. 10 1
      server.docker-compose.yml
  2. 13 0
      server/install/install.sh

+ 10 - 1
server.docker-compose.yml

@@ -12,6 +12,9 @@ services:
       - NOTIFICATION_ICON_URL=https://fcm.hostbbq.net/logo.png
     ports:
       - $HOST_PORT:$WEB_PORT
+    networks:
+      hostbbq-monitoring-vlan:
+        ipv4_address: 172.20.5.2
     links:
       - mariadb
     extra_hosts:
@@ -22,13 +25,19 @@ services:
       context: server/mysql
     image: monitoring-mariadb:latest
     ports:
-      - 3306:3306
+      - 172.20.5.3:3306:3306
+    networks:
+      hostbbq-monitoring-vlan:
+        ipv4_address: 172.20.5.3
     environment:
       - TZ=Europe/Berlin
       - MARIADB_ROOT_PASSWORD=i4mGr00ti4mGr00t
     volumes:
       - db-dir:/var/lib/mysql
     restart: always
+networks:
+  hostbbq-monitoring-vlan:
+    external: true
 volumes:
   db-dir:
     driver: local

+ 13 - 0
server/install/install.sh

@@ -78,6 +78,19 @@ envsubst < "$TMPFOLDER/server.docker-compose.yml" > "$INSTALL_DIR/docker-compose
 
 cd "$INSTALL_DIR"
 
+DOCKER_NETWORK_NAME=hostbbq-monitoring-vlan
+docker network inspect ${DOCKER_NETWORK_NAME} > /dev/null 2>&1; EC=$?
+if [[ $EC -ne 0 ]]; then
+  if [[ "${COMMAND}" == "up" ]]; then
+    echo "⭐ Creating network '${DOCKER_NETWORK_NAME}'..."
+    docker network create --subnet=172.20.5.0/24 "${DOCKER_NETWORK_NAME}"
+  fi
+else
+  if [[ "${COMMAND}" == "up" ]]; then
+    echo "✔ Network '${DOCKER_NETWORK_NAME}' exists."
+  fi
+fi
+
 COMPOSE_PROJECT_NAME="monitoring-server" \
 docker compose up -d --force-recreate