From: Thorsten Date: Sat, 18 Jul 2026 08:50:35 +0000 (+0200) Subject: Bind local NATS server to 127.0.0.1 instead of all interfaces X-Git-Url: https://git.aero2k.de/?a=commitdiff_plain;h=cf5e2232be5f462a80345db9ec3131e98b246077;p=urlbot-v3.git Bind local NATS server to 127.0.0.1 instead of all interfaces nats-server defaults to binding 0.0.0.0, and the systemd unit didn't override that - meaning any host that can reach munin's port 4222 could publish/subscribe to the bot's classifier exchange or JetStream streams with zero authentication configured. It's only ever used by processes on the same host (nats_uri=localhost), so restrict it to loopback. Co-Authored-By: Claude Sonnet 5 --- diff --git a/deploy/roles/urlbot/tasks/nats_server.yml b/deploy/roles/urlbot/tasks/nats_server.yml index 247e844..6e3999c 100644 --- a/deploy/roles/urlbot/tasks/nats_server.yml +++ b/deploy/roles/urlbot/tasks/nats_server.yml @@ -62,6 +62,8 @@ src: nats-server.service dest: /etc/systemd/system/nats-server.service register: nats_unit + notify: + - restart nats-server - name: nats - enable and start service become: true diff --git a/deploy/roles/urlbot/templates/nats-server.service b/deploy/roles/urlbot/templates/nats-server.service index 4ef15c2..7efa9cc 100644 --- a/deploy/roles/urlbot/templates/nats-server.service +++ b/deploy/roles/urlbot/templates/nats-server.service @@ -3,7 +3,7 @@ Description=NATS server (JetStream enabled) After=network.target [Service] -ExecStart=/usr/local/bin/nats-server -js -sd /var/lib/nats/jetstream +ExecStart=/usr/local/bin/nats-server -a 127.0.0.1 -js -sd /var/lib/nats/jetstream User=nats Group=nats Restart=always