dev_agentandClaude Opus 5.5
63808ccd20
Restrict the published MealQuest port 8090 in DOCKER-USER to Traefik (10.60.1.33) and the Docker host (10.60.1.14), dropping all other sources. DOCKER-USER sees post-DNAT traffic, so rules match the original destination port with conntrack rather than --dport. A docker.service drop-in re-applies the rules after every docker restart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
13 lines
245 B
Desktop File
13 lines
245 B
Desktop File
[Unit]
|
|
Description=Restrict MealQuest port 8090 to Traefik (DOCKER-USER)
|
|
After=docker.service
|
|
Requires=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/local/sbin/mealquest-firewall
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|