From 6204fb50f9c00e77031f2d98032ac0eb324e2b97 Mon Sep 17 00:00:00 2001 From: Jeppe B <2jepp9350@gmail.com> Date: Mon, 1 Jun 2026 21:59:27 +0200 Subject: [PATCH] Harden edge broker compose defaults --- docker-compose.example.yml | 8 ++++---- docker-compose.yml | 18 +++++++++--------- services/edge-broker/test/config.test.mjs | 12 ++++++------ 3 files changed, 19 insertions(+), 19 deletions(-) diff --git a/docker-compose.example.yml b/docker-compose.example.yml index 6cc669c2..4628e183 100644 --- a/docker-compose.example.yml +++ b/docker-compose.example.yml @@ -52,9 +52,9 @@ services: dockerfile: services/edge-broker/Dockerfile container_name: edge-broker environment: - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env} ports: - - "4300:4300" + - "127.0.0.1:4300:4300" caddy: image: caddy:2.7.6-alpine @@ -98,7 +98,7 @@ services: environment: AUTO_COMPOSER_INSTALL: "true" EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300} - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env} volumes: - ./services/nginx/app:/var/www/html - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro @@ -119,7 +119,7 @@ services: environment: AUTO_COMPOSER_INSTALL: "false" EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300} - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env} volumes: - ./services/nginx/app:/var/www/html - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro diff --git a/docker-compose.yml b/docker-compose.yml index 3f53f96c..fdea7c37 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -86,9 +86,9 @@ services: dockerfile: services/edge-broker/Dockerfile container_name: edge-broker environment: - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env} ports: - - "4300:4300" + - "127.0.0.1:4300:4300" caddy: image: caddy:2.7.6-alpine @@ -213,7 +213,7 @@ services: environment: AUTO_COMPOSER_INSTALL: "true" EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300} - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env} volumes: - ./services/nginx/app:/var/www/html - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro @@ -233,7 +233,7 @@ services: environment: AUTO_COMPOSER_INSTALL: "false" EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300} - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env} volumes: - ./services/nginx/app:/var/www/html - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro @@ -253,7 +253,7 @@ services: environment: AUTO_COMPOSER_INSTALL: "false" EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300} - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env} volumes: - ./services/nginx/app:/var/www/html - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro @@ -273,7 +273,7 @@ services: environment: AUTO_COMPOSER_INSTALL: "false" EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300} - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env} volumes: - ./services/nginx/app:/var/www/html - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro @@ -293,7 +293,7 @@ services: environment: AUTO_COMPOSER_INSTALL: "false" EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300} - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env} volumes: - ./services/nginx/app:/var/www/html - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro @@ -313,7 +313,7 @@ services: environment: AUTO_COMPOSER_INSTALL: "false" EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300} - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env} volumes: - ./services/nginx/app:/var/www/html - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro @@ -333,7 +333,7 @@ services: environment: AUTO_COMPOSER_INSTALL: "false" EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300} - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env} volumes: - ./services/nginx/app:/var/www/html - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro diff --git a/services/edge-broker/test/config.test.mjs b/services/edge-broker/test/config.test.mjs index 4edf5f26..59b28f64 100644 --- a/services/edge-broker/test/config.test.mjs +++ b/services/edge-broker/test/config.test.mjs @@ -35,20 +35,20 @@ test("traefik does not expose a dedicated public edge broker port", () => { assert.doesNotMatch(traefikSource, /edge-broker:\s*\n\s*address:\s*":4300"/); }); -test("base docker compose exposes the edge broker service on port 4300", () => { +test("base docker compose binds edge broker port 4300 to localhost only", () => { assert.match(baseComposeSource, /\bedge-broker:\b/); - assert.match(baseComposeSource, /edge-broker:\s*\n[\s\S]*?\n\s+ports:\s*\n\s+- "4300:4300"/); + assert.match(baseComposeSource, /edge-broker:\s*\n[\s\S]*?\n\s+ports:\s*\n\s+- "127.0.0.1:4300:4300"/); }); -test("example docker compose exposes the edge broker service on port 4300", () => { +test("example docker compose binds edge broker port 4300 to localhost only", () => { assert.match(exampleComposeSource, /\bedge-broker:\b/); - assert.match(exampleComposeSource, /edge-broker:\s*\n[\s\S]*?\n\s+ports:\s*\n\s+- "4300:4300"/); + assert.match(exampleComposeSource, /edge-broker:\s*\n[\s\S]*?\n\s+ports:\s*\n\s+- "127.0.0.1:4300:4300"/); }); test("php services receive broker websocket environment defaults", () => { for (const composeSource of [baseComposeSource, exampleComposeSource]) { assert.match(composeSource, /EDGE_BROKER_URL:\s*\$\{EDGE_BROKER_URL:-http:\/\/edge-broker:4300\}/); - assert.match(composeSource, /EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev\}/); + assert.match(composeSource, /EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:\?set EDGE_BROKER_SHARED_SECRET in \.env\}/); } }); @@ -57,6 +57,6 @@ test("base docker compose wires the broker into each php worker", () => { const serviceBlock = readComposeServiceBlock(baseComposeSource, serviceName); assert.match(serviceBlock, /\n\s+depends_on:\s*\n[\s\S]*?\n\s+- edge-broker/); assert.match(serviceBlock, /EDGE_BROKER_URL:\s*\$\{EDGE_BROKER_URL:-http:\/\/edge-broker:4300\}/); - assert.match(serviceBlock, /EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev\}/); + assert.match(serviceBlock, /EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:\?set EDGE_BROKER_SHARED_SECRET in \.env\}/); } });