Protect Caddy admin endpoints from being accessed from the internet

[bohdan-shulha]

One way is to make Caddy listen at the UNIX socket instead of a TCP port.

https://caddyserver.com/docs/caddyfile/options#admin

Cause - Docker. (:

https://docs.docker.com/engine/network/packet-filtering-firewalls/#integration-with-firewalld

(ufw) is a frontend that ships with Debian and Ubuntu, and it lets you manage firewall rules. Docker and ufw use iptables in ways that make them incompatible with each other.

When you publish a container's ports using Docker, traffic to and from that container gets diverted before it goes through the ufw firewall settings. Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration.

[bohdan-shulha]

The recipe to fix this issue:

1. Install netfilter-persistent

apt-get install netfilter-persistent

2. Add the rules to block outside actors accessing port 2019

iptables -I DOCKER-USER -p tcp -s 127.0.0.1 --dport 2019 -j ACCEPT
iptables -I DOCKER-USER -p tcp --dport 2019 -j REJECT --reject-with tcp-reset

3. Save your rules

netfilter-persistent save

Installation script has been updated to reflect the changes.