2 Commits

Include renames

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	5a1ee389dc	Keep MealQuest firewall rules first and off docker.service ... Address review of the port 8090 firewall: - Insert the three MealQuest rules at the top of DOCKER-USER, ahead of other projects' rules. Each run deletes every rule tagged "mealquest-firewall" and re-inserts them at positions 1-3, so re-runs restore the order and never duplicate. - Scope the match to MealQuest's published address with --ctorigdst 10.60.1.14, so outbound container connections to a remote :8090 are not matched. - Drop the docker.service ExecStartPost drop-in, which made a firewall error fatal to the shared Docker daemon. The unit is now PartOf= and WantedBy= docker.service: it re-runs on every Docker start or restart and fails visibly on its own without failing docker.service. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 17:47:36 -04:00
dev_agentandClaude Opus 5.5	63808ccd20	Add MealQuest host firewall unit for port 8090 ... Restrict the published MealQuest port 8090 in DOCKER-USER to Traefik (10.60.1.33) and the Docker host (10.60.1.14), dropping all other sources. DOCKER-USER sees post-DNAT traffic, so rules match the original destination port with conntrack rather than --dport. A docker.service drop-in re-applies the rules after every docker restart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 17:35:39 -04:00