fix(hosting): bind Postgres and the Traefik dashboard to loopback by default

A self-hoster on a public IP no longer exposes their database (default creds username/password) or an unauthenticated dashboard to the internet. Set POSTGRES_PORT=0.0.0.0:5432 to opt back in.

Claude-Session: https://claude.ai/code/session_01XhENr63WL9npkKrJGnzDc1

Author: mmabrouk

hosting/docker-compose/ee/docker-compose.dev.yml

@@ -464,7 +464,7 @@ services:
         networks:
             - agenta-network
         ports:
-            - "${POSTGRES_PORT:-5432}:5432"
+            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:
@@ -651,7 +651,7 @@ services:
             - agenta-network
         ports:
             - "${TRAEFIK_PORT:-80}:80"
-            - "${TRAEFIK_UI_PORT:-8080}:8080"
+            - "127.0.0.1:${TRAEFIK_UI_PORT:-8080}:8080"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:

hosting/docker-compose/ee/docker-compose.gh.local.yml

@@ -325,7 +325,7 @@ services:
         networks:
             - agenta-ee-gh-network
         ports:
-            - "${POSTGRES_PORT:-5432}:5432"
+            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:
@@ -415,7 +415,7 @@ services:
             - agenta-ee-gh-network
         ports:
             - "${TRAEFIK_PORT:-80}:80"
-            - "${TRAEFIK_UI_PORT:-8080}:8080"
+            - "127.0.0.1:${TRAEFIK_UI_PORT:-8080}:8080"
         # === LIFECYCLE ============================================ #
         restart: always
 

hosting/docker-compose/ee/docker-compose.gh.yml

@@ -323,7 +323,7 @@ services:
         networks:
             - agenta-ee-gh-network
         ports:
-            - "${POSTGRES_PORT:-5432}:5432"
+            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:
@@ -412,7 +412,7 @@ services:
             - agenta-ee-gh-network
         ports:
             - "${TRAEFIK_PORT:-80}:80"
-            - "${TRAEFIK_UI_PORT:-8080}:8080"
+            - "127.0.0.1:${TRAEFIK_UI_PORT:-8080}:8080"
         # === LIFECYCLE ============================================ #
         restart: always
 

hosting/docker-compose/oss/docker-compose.dev.yml

@@ -445,7 +445,7 @@ services:
         networks:
             - agenta-network
         ports:
-            - "${POSTGRES_PORT:-5432}:5432"
+            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:
@@ -628,7 +628,7 @@ services:
             - agenta-network
         ports:
             - "${TRAEFIK_PORT:-80}:80"
-            - "${TRAEFIK_UI_PORT:-8080}:8080"
+            - "127.0.0.1:${TRAEFIK_UI_PORT:-8080}:8080"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:

hosting/docker-compose/oss/docker-compose.gh.local.yml

@@ -323,7 +323,7 @@ services:
         networks:
             - agenta-oss-gh-network
         ports:
-            - "${POSTGRES_PORT:-5432}:5432"
+            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:
@@ -415,7 +415,7 @@ services:
             - agenta-oss-gh-network
         ports:
             - "${TRAEFIK_PORT:-80}:80"
-            - "${TRAEFIK_UI_PORT:-8080}:8080"
+            - "127.0.0.1:${TRAEFIK_UI_PORT:-8080}:8080"
         # === LIFECYCLE ============================================ #
         restart: always
 

hosting/docker-compose/oss/docker-compose.gh.ssl.yml

@@ -347,7 +347,7 @@ services:
         networks:
             - agenta-gh-ssl-network
         ports:
-            - "${POSTGRES_PORT:-5432}:5432"
+            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:
@@ -429,7 +429,7 @@ services:
             - agenta-gh-ssl-network
         ports:
             - "${TRAEFIK_PORT:-80}:80"
-            - "${TRAEFIK_UI_PORT:-8080}:8080"
+            - "127.0.0.1:${TRAEFIK_UI_PORT:-8080}:8080"
             - "${TRAEFIK_HTTPS_PORT:-443}:443"
         # === LIFECYCLE ============================================ #
         restart: always

hosting/docker-compose/oss/docker-compose.gh.yml

@@ -340,7 +340,7 @@ services:
         networks:
             - agenta-oss-gh-network
         ports:
-            - "${POSTGRES_PORT:-5432}:5432"
+            - "${POSTGRES_PORT:-127.0.0.1:5432}:5432"
         # === LIFECYCLE ============================================ #
         restart: always
         healthcheck:
@@ -432,7 +432,7 @@ services:
             - agenta-oss-gh-network
         ports:
             - "${TRAEFIK_PORT:-80}:80"
-            - "${TRAEFIK_UI_PORT:-8080}:8080"
+            - "127.0.0.1:${TRAEFIK_UI_PORT:-8080}:8080"
         # === LIFECYCLE ============================================ #
         restart: always