mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
dd05caa34f
A port under ports.local or ports.public binds an address on the stack host, which is what a HiddenServicePort can forward to. Whether it should be forwarded has a cost in both directions: silently off leaves a service unreachable that the operator believes is on the onion, and silently on publishes a database, an admin interface or a SOCKS proxy to everyone holding the onion address. Neither belongs in a default, so the flag is now mandatory and every false carries the reason it is false. The first run produced 165 findings, of which 131 were one architectural fact repeated rather than 131 decisions. Four groups are therefore settled once in the lint instead: the proxy-fronted http, sso and websocket, because the node onion already forwards port 80 to the reverse proxy that routes every vhost, oauth2 hop and socket upgrade behind it; the implicit-TLS variants, because Tor is already the transport encryption and container_ports drops those listeners when TLS is off, which an onion deployment always is; the categories a hidden service cannot carry, listed once in plugins.lookup.tor_ports.UDP_ONLY_CATEGORIES, which the lint imports rather than restates; and any entity that already answers the question through exposed:. That leaves 23 real per-port decisions, each with a reason naming its own consumer. svc-net-tor keeps its own socks, trans and dns off the onion: a published SOCKS port is an open proxy, and SocksPolicy cannot refuse it because the forward arrives from the node's own address. Mailu turns smtp, submission, imap and pop3 on, which is what makes sending and receiving work over the onion, and leaves sieve off because ManageSieve manages filters rather than mail. Measured end to end through the merged applications view, across all 105 roles the deploy now forwards exactly 25, 110, 143 and 587. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
45 lines
1.0 KiB
YAML
45 lines
1.0 KiB
YAML
---
|
|
# nocheck: dynamic-flag
|
|
node:
|
|
enabled: true
|
|
shared: true
|
|
bond: 1
|
|
docker:
|
|
healthcheck:
|
|
flavor: wget
|
|
port_key: registry
|
|
path: v2/
|
|
modes:
|
|
compose:
|
|
enabled: true
|
|
swarm:
|
|
enabled: false
|
|
# nocheck: default-placement-manager local registry that holds locally-built infinito images for docker stack deploy; chicken-and-egg if scheduled on a worker
|
|
placement: manager
|
|
enabled: true
|
|
shared: true
|
|
bond: 1
|
|
image: registry
|
|
version: "3"
|
|
name: registry
|
|
min_storage: 221MB
|
|
backup:
|
|
disabled: true
|
|
cpus: "0.5"
|
|
mem_reservation: 128m
|
|
mem_limit: 512m
|
|
pids_limit: 256
|
|
ports:
|
|
local:
|
|
registry: 5000
|
|
internal:
|
|
registry: 5000
|
|
onion:
|
|
# nocheck: onion-flag the registry accepts unauthenticated pushes from the node that builds into it, so its reach must stay the node
|
|
registry: false
|
|
lifecycle: beta
|
|
# nocheck: dynamic-flag - locally built images are rebuildable, the backup consumer stays permanently off
|
|
container_backup:
|
|
enabled: false
|
|
shared: true
|