Repository navigation
fix(providers): bind provisioned service ports to 127.0.0.1 instead of 0.0.0.0 - #190
Merged
dviejokfs merged 2 commits intoJul 4, 2026
Conversation
Contributor
|
@bherila could you fix the formatting for this PR and the others that are also failing? |
Contributor
Author
|
yes everything will be fixed up. sorry my codespace timed out and left unfinished work |
…f 0.0.0.0 Managed Postgres/Redis/MongoDB/S3(RustFS) containers were publishing their ports to 0.0.0.0 -- publicly reachable on any host without an external firewall -- while docs/howto/set-up-managed-services already claimed they were bound to 127.0.0.1 only. Factor the binding logic into a single crate::utils::local_port_binding helper used by every provider, so there's one place that can leak 0.0.0.0 instead of five. Also removes/marks-aspirational the `temps firewall` CLI and config/settings.yml claims in docs/advanced/security -- neither exists in the codebase.
bherila
force-pushed
the
fix/soc2-provisioned-service-port-binding-upstream-pr
branch
from
July 3, 2026 19:52
5c14297 to
06d2883
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Managed services provisioned by Temps (Postgres, Redis, MongoDB, S3/RustFS) were binding their Docker-published ports to
0.0.0.0— publicly reachable on any host without an external firewall in front of it — whiledocs/howto/set-up-managed-servicesalready claims "All ports are bound to127.0.0.1only." This closes that gap so the code actually matches the documented behavior.Factored the binding logic into a single
crate::utils::local_port_bindinghelper (with tests asserting it never returns0.0.0.0), used consistently bypostgres.rs,redis.rs,s3.rs,rustfs.rs(both its data and console ports), andpostgres_lifecycle.rs— a fifth call site the original audit had missed.Also cleans up
docs/advanced/securityto remove references to atemps firewallCLI command and aconfig/settings.ymlfile, neither of which exists in this codebase (tracked as part of bherila#37).Why
Self-hosting hardening pass (applies to anyone running Temps for a production workload, not specific to any one deployment) — tracked in bherila#29 and part of bherila#37.
Testing
cargo check --lib -p temps-providers: clean, zero warnings.cargo test --lib -p temps-providers: 238 passed, 0 failed (includes 2 new tests for the port-binding helper).