dev_agentandClaude Opus 5.5
5a1ee389dc
Address review of the port 8090 firewall: - Insert the three MealQuest rules at the top of DOCKER-USER, ahead of other projects' rules. Each run deletes every rule tagged "mealquest-firewall" and re-inserts them at positions 1-3, so re-runs restore the order and never duplicate. - Scope the match to MealQuest's published address with --ctorigdst 10.60.1.14, so outbound container connections to a remote :8090 are not matched. - Drop the docker.service ExecStartPost drop-in, which made a firewall error fatal to the shared Docker daemon. The unit is now PartOf= and WantedBy= docker.service: it re-runs on every Docker start or restart and fails visibly on its own without failing docker.service. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
23 lines
725 B
Desktop File
23 lines
725 B
Desktop File
# Applies the MealQuest DOCKER-USER rules (/usr/local/sbin/mealquest-firewall).
|
|
#
|
|
# PartOf= re-runs this unit whenever docker.service is stopped or restarted,
|
|
# and WantedBy=docker.service starts it whenever docker.service starts. Both
|
|
# are one-way: a failure here fails this unit visibly and never fails
|
|
# docker.service.
|
|
#
|
|
# Start MealQuest only after this unit has succeeded:
|
|
# systemctl start mealquest-firewall && docker compose up -d
|
|
[Unit]
|
|
Description=Restrict MealQuest port 8090 to Traefik (DOCKER-USER)
|
|
After=docker.service
|
|
Requires=docker.service
|
|
PartOf=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/local/sbin/mealquest-firewall
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target docker.service
|