Change server bindings to localhost (#1)

* fix(security): change server bindings from 0.0.0.0 to 127.0.0.1

* feat(security): implement SSL/TLS certificate support

---------

Co-authored-by: nisolanki1209 <nisolanki@gmail.com>

Author: nisolanki1209

comfyui/README.md

@@ -6,8 +6,10 @@ Powerful node-based interface for Stable Diffusion image generation.
 
 - **ComfyUI** - Node-based UI for Stable Diffusion
 - **ComfyUI-Manager** - Model manager & custom node installer (⭐ **NEW**)
+- **OpenSSL** - For SSL certificate generation
 - **PyTorch** - With CUDA GPU support
 - **Stable Diffusion 1.5** - Starter model (pre-downloaded)
+- **SSL/TLS certificates** - Self-signed certificates for HTTPS access
 - **Systemd service** - Auto-starts with system
 - **Python virtual environment** - Clean isolation
 
@@ -19,11 +21,14 @@ Powerful node-based interface for Stable Diffusion image generation.
 - **Custom nodes** - Extensible with community plugins
 - **Multiple models** - Support for SD 1.5, SDXL, LoRAs, etc.
 - **Batch processing** - Generate multiple images
+- **Secure by default** - Bound to localhost for security
 
-## ⚠️ Required Port
+## 🔒 Security
 
-To access from outside Brev, open:
-- **8188/tcp** (ComfyUI web interface)
+- **HTTPS/SSL encryption** - All traffic encrypted with TLS/SSL
+- **Localhost binding** - Service is bound to `127.0.0.1` only (not exposed to network)
+- **Self-signed certificates** - Automatically generated SSL certificates (valid for 1 year)
+- **Secure remote access** - Use SSH port forwarding for remote access
 
 ## Requirements
 
@@ -41,17 +46,41 @@ Takes ~5-10 minutes (downloads model).
 
 ## What you get
 
-- **Web UI:** `http://localhost:8188`
+- **Web UI:** `https://localhost:8188`
 - **Installation:** `~/ComfyUI`
 - **Models:** `~/ComfyUI/models/checkpoints`
+- **SSL certificates:** `~/ComfyUI/certs/`
 - **Service:** Auto-starts on boot
 
+## Access & Remote Access
+
+### Local Access
+
+The service is bound to `localhost` (127.0.0.1) for security. Access it locally via HTTPS:
+
+```bash
+# Open in browser on the server
+https://localhost:8188
+```
+
+### Remote Access via SSH Port Forwarding
+
+For secure remote access, use SSH port forwarding:
+
+```bash
+# From your local machine
+ssh -L 8188:localhost:8188 user@your-server
+
+# Then access in your local browser
+https://localhost:8188
+```
+
 ## Quick Start
 
 **Access the UI:**
 ```bash
-# Open in browser (or via your Brev URL with port 8188)
-http://localhost:8188
+# Open in browser (local or via SSH port forwarding)
+https://localhost:8188
 ```
 
 **⭐ Download Models (using ComfyUI-Manager):**
@@ -268,7 +297,7 @@ sudo journalctl -u comfyui -n 50
 
 **Can't access UI:**
 - Check service: `sudo systemctl status comfyui`
-- Check port: `lsof -i :8188`
+- For remote access, use SSH port forwarding (see above)
 - View logs: `sudo journalctl -u comfyui -f`
 
 ## Python API
@@ -285,7 +314,7 @@ workflow = {
 }
 
 response = requests.post(
-    "http://localhost:8188/prompt",
+    "https://localhost:8188/prompt",
     json={"prompt": workflow}
 )
 

comfyui/setup.sh

@@ -46,7 +46,7 @@ fi
 # Install dependencies
 echo "Installing system dependencies..."
 sudo apt-get update -qq
-sudo apt-get install -y -qq git python3-pip python3-venv
+sudo apt-get install -y -qq git python3-pip python3-venv openssl
 
 # Clone ComfyUI
 if [ -d "$HOME/ComfyUI" ]; then
@@ -122,16 +122,57 @@ else
     echo "Model already exists, skipping download"
 fi
 
-# Create start script
-cat > "$HOME/ComfyUI/start.sh" << 'EOF'
+# Generate SSL/TLS certificate and key
+echo "Generating SSL/TLS certificate and key..."
+CERT_DIR="$HOME/ComfyUI/certs"
+mkdir -p "$CERT_DIR"
+cd "$CERT_DIR"
+
+# Get hostname or IP for certificate
+HOSTNAME=$(hostname -f 2>/dev/null || hostname 2>/dev/null || echo "localhost")
+IP_ADDRESS=$(hostname -I | awk '{print $1}' 2>/dev/null || echo "127.0.0.1")
+
+if [ ! -f "$CERT_DIR/key.pem" ] || [ ! -f "$CERT_DIR/cert.pem" ]; then
+    echo "Creating self-signed certificate (valid for 1 years)..."
+    if [ "$(id -u)" -eq 0 ]; then
+        sudo -H -u $USER openssl req -x509 -newkey rsa:4096 \
+            -keyout "$CERT_DIR/key.pem" \
+            -out "$CERT_DIR/cert.pem" \
+            -sha256 -days 365 -nodes \
+            -subj "/O=ComfyUI/OU=IT/CN=$HOSTNAME"
+    else
+        openssl req -x509 -newkey rsa:4096 \
+            -keyout "$CERT_DIR/key.pem" \
+            -out "$CERT_DIR/cert.pem" \
+            -sha256 -days 365 -nodes \
+            -subj "/O=ComfyUI/OU=IT/CN=$HOSTNAME"
+    fi
+    
+    # Set secure permissions
+    chmod 600 "$CERT_DIR/key.pem"
+    chmod 644 "$CERT_DIR/cert.pem"
+    
+    if [ "$(id -u)" -eq 0 ]; then
+        chown $USER:$USER "$CERT_DIR/key.pem" "$CERT_DIR/cert.pem"
+    fi
+    
+    echo "✓ SSL certificate and key generated"
+    echo "  Certificate: $CERT_DIR/cert.pem"
+    echo "  Private Key: $CERT_DIR/key.pem"
+else
+    echo "SSL certificate and key already exist, skipping generation"
+fi
+
+# Create start script with HTTPS support
+cat > "$HOME/ComfyUI/start.sh" << EOF
 #!/bin/bash
 cd ~/ComfyUI
 source venv/bin/activate
-python main.py --listen 0.0.0.0 --port 8188
+python main.py --listen localhost --port 8188 --tls-keyfile $CERT_DIR/key.pem --tls-certfile $CERT_DIR/cert.pem
 EOF
 chmod +x "$HOME/ComfyUI/start.sh"
 
-# Create systemd service
+# Create systemd service with HTTPS support
 sudo tee /etc/systemd/system/comfyui.service > /dev/null << EOF
 [Unit]
 Description=ComfyUI
@@ -141,7 +182,7 @@ After=network.target
 Type=simple
 User=$USER
 WorkingDirectory=$HOME/ComfyUI
-ExecStart=$HOME/ComfyUI/venv/bin/python main.py --listen 0.0.0.0 --port 8188
+ExecStart=$HOME/ComfyUI/venv/bin/python main.py --listen localhost --port 8188 --tls-keyfile $CERT_DIR/key.pem --tls-certfile $CERT_DIR/cert.pem
 Restart=on-failure
 
 [Install]
@@ -174,13 +215,15 @@ else
 fi
 
 echo ""
-echo "✅ ComfyUI ready!"
+echo "✅ ComfyUI ready with HTTPS enabled!"
+echo ""
+echo "🔒 HTTPS Access: https://localhost:8188"
 echo ""
-echo "Access: http://localhost:8188"
 echo "⚠️  Open port 8188/tcp to access from outside Brev"
 echo ""
 echo "Location: $HOME/ComfyUI"
 echo "Models: $HOME/ComfyUI/models/checkpoints"
+echo "SSL Certificates: $CERT_DIR"
 echo ""
 echo "✨ ComfyUI-Manager installed!"
 echo "   Click the 'Manager' button in the UI to:"
@@ -192,4 +235,8 @@ echo "Manage service:"
 echo "  sudo systemctl status comfyui"
 echo "  sudo journalctl -u comfyui -f"
 echo "  cd ~/ComfyUI && ./start.sh  # Manual start"
-
+echo ""
+echo "SSL Certificate Info:"
+echo "  Certificate: $CERT_DIR/cert.pem"
+echo "  Private Key: $CERT_DIR/key.pem"
+echo "  Valid for: 1 year"

databases/README.md

@@ -21,50 +21,128 @@ Takes ~1-2 minutes (downloads Docker images).
 **PostgreSQL:**
 - Host: `localhost:5432`
 - User: `postgres`
-- Password: `postgres`
+- Password: Auto-generated (stored in `~/.db_passwords.env`)
 - Database: `postgres`
-- **Port to open:** `5432/tcp`
+- SSL certificates: `~/database_certs/postgres/`
 
 **Redis:**
 - Host: `localhost:6379`
-- No password
-- **Port to open:** `6379/tcp`
+- Password: Auto-generated (stored in `~/.db_passwords.env`)
+- TLS certificates: `~/database_certs/redis/`
 
-## ⚠️ Required Ports
+## Access & Remote Access
 
-To access from outside Brev, open these ports:
-- **5432/tcp** - PostgreSQL
-- **6379/tcp** - Redis
+### Local Access
+
+Both services are bound to `localhost` (127.0.0.1) for security and use SSL/TLS encryption:
+
+```bash
+# PostgreSQL
+psql -h localhost -U postgres
+
+# Redis
+redis-cli -h localhost
+```
+
+### Remote Access via SSH Port Forwarding
+
+For secure remote access, use SSH port forwarding:
+
+```bash
+# From your local machine - PostgreSQL
+ssh -L 5432:localhost:5432 user@your-server
+
+# From your local machine - Redis
+ssh -L 6379:localhost:6379 user@your-server
+
+# Then connect from your local machine
+psql -h localhost -U postgres
+redis-cli -h localhost
+```
+
+## Retrieve Passwords
+
+Passwords are stored securely in `~/.db_passwords.env`:
+
+```bash
+# View PostgreSQL password
+grep POSTGRES_PASSWORD ~/.db_passwords.env
+
+# View Redis password
+grep REDIS_PASSWORD ~/.db_passwords.env
+
+# Or view the entire file
+cat ~/.db_passwords.env
+```
 
 ## Connect to PostgreSQL
 
 ```bash
 # Using psql
+psql -h localhost -U postgres
+# Enter password when prompted (retrieve from ~/.db_passwords.env)
+
+# Or using Docker exec (no password needed)
 docker exec -it postgres psql -U postgres
 
 # Or install client
 sudo apt install postgresql-client
 psql -h localhost -U postgres
 ```
 
+**Using password from environment:**
+```bash
+source ~/.db_passwords.env
+psql -h localhost -U postgres -W
+# Enter password: $POSTGRES_PASSWORD
+```
+
 ## Connect to Redis
 
 ```bash
 # Using redis-cli
+redis-cli -h localhost
+# Enter password: AUTH <password> (retrieve from ~/.db_passwords.env)
+
+# Or using Docker exec (no password needed)
 docker exec -it redis redis-cli
 
 # Or install client
 sudo apt install redis-tools
-redis-cli
+redis-cli -h localhost
 ```
 
+**Using password from environment:**
+```bash
+source ~/.db_passwords.env
+redis-cli -h localhost -a "$REDIS_PASSWORD"
+```
+
+## Connection Strings
+
+**PostgreSQL:**
+```bash
+# From environment file
+source ~/.db_passwords.env
+export PGPASSWORD="$POSTGRES_PASSWORD"
+psql -h localhost -U postgres -d postgres
+```
+
+**Redis:**
+```bash
+# From environment file
+source ~/.db_passwords.env
+redis-cli -h localhost -a "$REDIS_PASSWORD"
+
 ## Manage containers
 
 ```bash
 docker ps                    # See running containers
 docker stop postgres redis   # Stop databases
 docker start postgres redis  # Start databases
 docker logs postgres         # View logs
+docker logs redis            # View Redis logs
 docker exec -it postgres bash # Get shell in container
+docker exec -it redis redis-cli # Redis CLI
 ```