bisco/loadbalancer
1
0
Fork 0
generated from bisco/codex-bootstrap
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: route host loopback backends

Browse Source
This commit is contained in:
Alfredo Di Stasio
2026-06-30 10:16:03 +02:00
parent f3759e76ea
commit 1509c1e5fd
11 changed files with 46 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security.md
+3 -3
View File
@@ -13,9 +13,9 @@ Backend services are responsible for:
## Network exposure
Compose publishes `80/tcp` for HTTP-01 certificate challenges and `443/tcp` for TLS passthrough traffic. The Traefik ping entrypoint listens inside the container for healthchecks and is not published on the host.
Traefik uses host networking and listens directly on host ports `80/tcp` for HTTP traffic and `443/tcp` for TLS passthrough traffic. The Traefik ping entrypoint listens on host port `8082/tcp` for healthchecks; restrict this port with host firewall rules if needed.
The HTTP routers only match `/.well-known/acme-challenge/` paths for configured hostnames.
The HTTP routers match configured hostnames and forward the full HTTP request to the selected backend. Backend services are responsible for redirects and ACME challenge handling.
## Container hardening
@@ -23,7 +23,7 @@ The Traefik service:
- does not mount the Docker socket;
- is not privileged;
- drops Linux capabilities;
- drops Linux capabilities except `NET_BIND_SERVICE`, which is required to bind host ports `80` and `443`;
- enables `no-new-privileges`;
- mounts configuration read-only;
- uses an explicit Traefik image tag instead of `latest`.