5005a4980a
- Bind Loki to 127.0.0.1:3100 instead of 0.0.0.0:3100 to prevent external access - Add Traefik labels for secure HTTPS access with Authentik authentication - Bind Blackbox Exporter to 127.0.0.1:9115 instead of 0.0.0.0:9115 - Add Traefik labels for secure monitoring dashboard access - Enable Authentik middleware for Portainer (was disabled temporarily) - Services are now only accessible through Traefik reverse proxy with HTTPS and SSO Fixes critical security issues: - Prevents direct access to monitoring services (CVSS 9.8-9.1) - Eliminates log file exposure through public Loki port - Restricts infrastructure reconnaissance via Blackbox exporter - Enforces authentication for critical management tools 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
29 lines
882 B
YAML
29 lines
882 B
YAML
version: '3.8'
|
|
|
|
services:
|
|
blackbox-exporter:
|
|
image: prom/blackbox-exporter:latest
|
|
container_name: blackbox-exporter
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:9115:9115"
|
|
volumes:
|
|
- ./blackbox.yml:/etc/blackbox_exporter/config.yml
|
|
command:
|
|
- '--config.file=/etc/blackbox_exporter/config.yml'
|
|
networks:
|
|
- monitoring_monitoring
|
|
- traefik-public
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.blackbox.rule=Host(`blackbox.ai-impress.com`)"
|
|
- "traefik.http.routers.blackbox.entrypoints=websecure"
|
|
- "traefik.http.routers.blackbox.tls.certresolver=cloudflare"
|
|
- "traefik.http.routers.blackbox.middlewares=authentik@file"
|
|
- "traefik.http.services.blackbox.loadbalancer.server.port=9115"
|
|
|
|
networks:
|
|
monitoring_monitoring:
|
|
external: true
|
|
traefik-public:
|
|
external: true
|