dev_agentandClaude Opus 5.5
7797b3958f
The firewall script deleted its rules before re-inserting them, and Docker restarted the stack on its own (restart: unless-stopped) with no ordering against the firewall unit, so port 8090 could be open to the LAN while the rules were reapplied. - mealquest-firewall.sh fails closed: if the chain is not already exactly right, it inserts the DROP at position 1 first, deletes its other tagged rules by number, then inserts the two RETURN rules above it. A correct chain is left untouched. - New mealquest.service owns the compose stack: Requires= and After= mealquest-firewall.service, PartOf=docker.service. - compose.yaml: restart: "no" on both services, so Docker never starts them before the firewall. - RUNBOOK: deploy, rollback, restore and key rotation start and stop the stack with systemctl; documents the stack unit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
23 lines
864 B
Desktop File
23 lines
864 B
Desktop File
# Owns the MealQuest compose stack (deploy/compose.yaml). The services use
|
|
# restart: "no", so Docker never starts them on its own; this unit is the
|
|
# only start path.
|
|
#
|
|
# Requires= and After=mealquest-firewall.service start the stack only after
|
|
# the DOCKER-USER rules are applied, and not at all if that unit fails.
|
|
# PartOf=docker.service propagates a Docker stop or restart here, so a
|
|
# Docker restart re-applies the firewall before the stack comes back.
|
|
[Unit]
|
|
Description=MealQuest compose stack
|
|
Requires=mealquest-firewall.service
|
|
After=mealquest-firewall.service docker.service
|
|
PartOf=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/bin/docker compose -f /home/overseer/mealquest/deploy/compose.yaml up -d
|
|
ExecStop=/usr/bin/docker compose -f /home/overseer/mealquest/deploy/compose.yaml down
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|