Remove PostgreSQL host port exposure for production #132

New Issue

marcel · 2026-03-28T08:40:25+01:00

marcel commented

2026-03-28 08:40:25 +01:00

Priority: medium — must be resolved before production deployment

docker-compose.yml exposes the PostgreSQL port to the host (line 14):

ports:
  - "${PORT_DB}:5432"

On a production VPS, this makes port 5432 reachable from outside the Docker network. The backend connects via the internal archive-net network — there is no legitimate reason to expose this port.

What to do

In the production compose file/overlay, replace ports with expose:

services:
  db:
    expose:
      - "5432"
    # remove the ports: block entirely

expose makes the port available to other containers on the same network but not to the host or external traffic.

The development docker-compose.yml can keep ports for connecting with local DB tools (e.g. DBeaver, psql).

**Priority: medium — must be resolved before production deployment** `docker-compose.yml` exposes the PostgreSQL port to the host (line 14): ```yaml ports: - "${PORT_DB}:5432" ``` On a production VPS, this makes port 5432 reachable from outside the Docker network. The backend connects via the internal `archive-net` network — there is no legitimate reason to expose this port. ## What to do In the production compose file/overlay, replace `ports` with `expose`: ```yaml services: db: expose: - "5432" # remove the ports: block entirely ``` `expose` makes the port available to other containers on the same network but not to the host or external traffic. The development `docker-compose.yml` can keep `ports` for connecting with local DB tools (e.g. DBeaver, psql).

marcel added the phase-1: security label 2026-03-28 08:51:22 +01:00

marcel referenced this issue

2026-03-28 08:52:14 +01:00

Create docker-compose.prod.yml with Caddy reverse proxy and TLS #136

marcel added the devops label 2026-03-28 10:47:25 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: marcel/familienarchiv#132