From 97df1c2032af5876e7c2bc6fd4c257d051503062 Mon Sep 17 00:00:00 2001
From: mguschin <gn.mikle@gmail.com>
Date: Sun, 18 Oct 2026 20:15:42 +0300
Subject: [PATCH] Bind Gitea web port to loopback only

nginx is the only consumer; 0.0.0.0:3000 exposed Gitea directly and
was used to plant a Monero miner (Sep 2026).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docker-compose.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 049a5ed..c2e5f0a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -28,7 +28,9 @@ services:
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     ports:
-      - "${GITEA_HTTP_PORT}:3000"
+      # Web is loopback-only: nginx (repos.guschin.info) is the only consumer.
+      # Was 0.0.0.0 — exposed Gitea directly; exploited for a miner in Sep 2026.
+      - "127.0.0.1:${GITEA_HTTP_PORT}:3000"
       - "${GITEA_SSH_PORT}:22"
     extra_hosts:
       - "host.docker.internal:host-gateway"