Dilshod Rasulov
0662dda6ae
Some checks failed
Deploy to Production / Trigger production update (push) Failing after 11s
compose.prod.yml has always intended to take the app and frontend off the host interface and let nginx front them — "remove port exposure (nginx will handle it)". It did not work: Compose concatenates list-valued fields when merging -f files, so `ports: []` contributed nothing and 8000:8000 and 3001:80 survived from compose.yml. The effect was that an SSL deployment still answered on both ports over plain HTTP, bypassing TLS, HSTS, the security headers and the rate limits — confirmed against the live host from off-box, where the API returned its health payload unencrypted on :8000 and the panel loaded on :3001. Use the !reset tag so the inherited value is dropped rather than extended. Verified in place: the merged config now publishes only 80 and 443, both former ports refuse connections from outside, and the panel still serves over HTTPS.
2.9 KiB
2.9 KiB