582cc81ffe
A stack with TLS in front of it was still publishing nginx on 0.0.0.0, so the admin stayed reachable over plain HTTP on a raw port while the proxy served the same site over HTTPS beside it. On this project's own instance that meant wp-login.php answering 200 to the open internet. There is no password to steal — the account is a key — but the session cookie is the account, and a cookie read off the wire is a logged-in administrator. HTTP_BIND defaults to 0.0.0.0, so a stack with nothing in front behaves exactly as before. The records doc now also explains the pinned self-signed certificate route, which is how a BCNR name gets HTTPS without a certificate authority — and why an editor needs it at all: the publishing key is derived in the page, and crypto.subtle does not exist outside a secure context. |
||
|---|---|---|
| .. | ||
| nginx | ||
| .env.example | ||
| docker-compose.yml | ||
| Dockerfile | ||
| entrypoint.sh | ||