Add MealQuest host firewall unit for port 8090

Restrict the published MealQuest port 8090 in DOCKER-USER to Traefik (10.60.1.33) and the Docker host (10.60.1.14), dropping all other sources. DOCKER-USER sees post-DNAT traffic, so rules match the original destination port with conntrack rather than --dport. A docker.service drop-in re-applies the rules after every docker restart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-05 17:35:39 -04:00
parent 3b524ec118
commit 63808ccd20
3 changed files with 36 additions and 0 deletions
@@ -0,0 +1,3 @@
+# Re-apply the MealQuest DOCKER-USER rules after every docker (re)start.
+[Service]
+ExecStartPost=/usr/local/sbin/mealquest-firewall