open ports

Best security practice in general is to reduce surface expose in the first place, rather than rely on firewalls, auth, etc. Especially considering that there may be protocol-level vulnerabilities that occur before auth completes.

I've been removing the clickhouse ports manually already (annoying/frustrating). But now I see redis is creeping in with the latest version of rybbit, I'm worried that we aren't setting safe defaults for users.

Could we:

(1) Commit to a future policy of default-closed for all dependencies and services? This is secure by default, and ensures that only people that /want/ to open themselves up can do it manually and then face their own footguns. (2) Close out all existing unnecessary ports? (3) For any ports that are open, default them to 127.0.0.1. If someone wishes to expose them to 0.0.0.0, then make that the opt-in.

Part (2) is challenging, and may benefit from the use of docker compose profiles or something else. Here's the conundrum: When caddy is in use, then neither the client nor backend services should be exposed (I think?). But if caddy is disabled, then both client and server should be open.

Part (3) I proposed in a specific way because I imagine that if someone isn't using caddy, then they are probably running their own proxy locally anyhow. So 127.0.0.1 makes sense. If they are using cloudflare, then perhaps they'll also use cloudflared for the tunnel, in which case again 127.0.0.1 makes sense. Anything else should IMHO require opt-in.

Happy to brainstorm more.