From cdd364e6454e2d4a5a742e3d98c513cd865978c6 Mon Sep 17 00:00:00 2001
From: "Gan, Jimmy" <jimmy.gan@adidas.com>
Date: Sat, 28 Feb 2026 22:47:36 +0800
Subject: [PATCH] security: bind service ports to localhost only

Bind navidrome, n8n, immich, openclaw, gitea web ports to 127.0.0.1
to prevent direct LAN access bypassing Caddy/Authelia.

Tailscale userspace networking on Synology proxies through localhost,
so VPS Caddy access via Tailscale IP continues to work.

Gitea SSH port (2222) remains on all interfaces for external git push.
---
 gitea/docker-compose.yml     | 2 +-
 immich/docker-compose.yml    | 2 +-
 n8n/docker-compose.yml       | 2 +-
 navidrome/docker-compose.yml | 2 +-
 openclaw/docker-compose.yml  | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/gitea/docker-compose.yml b/gitea/docker-compose.yml
index 87c65da..94f6163 100755
--- a/gitea/docker-compose.yml
+++ b/gitea/docker-compose.yml
@@ -30,7 +30,7 @@ services:
       - /etc/TZ:/etc/TZ:ro
       - /etc/localtime:/etc/localtime:ro
     ports:
-      - "3300:3000"
+      - "127.0.0.1:3300:3000"
       - "2222:22"
     depends_on:
       - db
diff --git a/immich/docker-compose.yml b/immich/docker-compose.yml
index 9e73c37..952ec8f 100644
--- a/immich/docker-compose.yml
+++ b/immich/docker-compose.yml
@@ -4,7 +4,7 @@ services:
     container_name: immich-server
     restart: unless-stopped
     ports:
-      - "2283:2283"
+      - "127.0.0.1:2283:2283"
     volumes:
       - ${UPLOAD_LOCATION}:/usr/src/app/upload
       - /volume1/photo:/mnt/photo:ro
diff --git a/n8n/docker-compose.yml b/n8n/docker-compose.yml
index 2eb104f..ec4850d 100644
--- a/n8n/docker-compose.yml
+++ b/n8n/docker-compose.yml
@@ -4,7 +4,7 @@ services:
     container_name: n8n
     restart: unless-stopped
     ports:
-      - "5678:5678"
+      - "127.0.0.1:5678:5678"
     volumes:
       - ./data:/home/node/.n8n
     environment:
diff --git a/navidrome/docker-compose.yml b/navidrome/docker-compose.yml
index dc1967a..63effe1 100644
--- a/navidrome/docker-compose.yml
+++ b/navidrome/docker-compose.yml
@@ -4,7 +4,7 @@ services:
     container_name: navidrome
     restart: unless-stopped
     ports:
-      - "4533:4533"
+      - "127.0.0.1:4533:4533"
     environment:
       ND_SCANSCHEDULE: 1h
       ND_LOGLEVEL: info
diff --git a/openclaw/docker-compose.yml b/openclaw/docker-compose.yml
index ed69634..9487617 100644
--- a/openclaw/docker-compose.yml
+++ b/openclaw/docker-compose.yml
@@ -4,7 +4,7 @@ services:
     container_name: openclaw-gateway
     restart: unless-stopped
     ports:
-      - "3100:18789"
+      - "127.0.0.1:3100:18789"
     environment:
       HOME: /home/node
       TERM: xterm-256color