Bind local NATS server to 127.0.0.1 instead of all interfaces

nats-server defaults to binding 0.0.0.0, and the systemd unit didn't
override that - meaning any host that can reach munin's port 4222 could
publish/subscribe to the bot's classifier exchange or JetStream streams
with zero authentication configured. It's only ever used by processes on
the same host (nats_uri=localhost), so restrict it to loopback.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

diff --git a/deploy/roles/urlbot/tasks/nats_server.yml b/deploy/roles/urlbot/tasks/nats_server.yml
index 247e8442a8249905b9e94c22f94821df0c9dc42c..6e3999c7e95a2afe6ccb42943225ba0064262838 100644 (file)
--- a/deploy/roles/urlbot/tasks/nats_server.yml
+++ b/deploy/roles/urlbot/tasks/nats_server.yml
@@ -62,6 +62,8 @@
     src: nats-server.service
     dest: /etc/systemd/system/nats-server.service
   register: nats_unit
+  notify:
+    - restart nats-server
 
 - name: nats - enable and start service
   become: true

diff --git a/deploy/roles/urlbot/templates/nats-server.service b/deploy/roles/urlbot/templates/nats-server.service
index 4ef15c2b078176eafeb29a361e7301d5cdf0792d..7efa9cc02363b556e195062ec8447edf23980501 100644 (file)
--- a/deploy/roles/urlbot/templates/nats-server.service
+++ b/deploy/roles/urlbot/templates/nats-server.service
@@ -3,7 +3,7 @@ Description=NATS server (JetStream enabled)
 After=network.target
 
 [Service]
-ExecStart=/usr/local/bin/nats-server -js -sd /var/lib/nats/jetstream
+ExecStart=/usr/local/bin/nats-server -a 127.0.0.1 -js -sd /var/lib/nats/jetstream
 User=nats
 Group=nats
 Restart=always