Propose binding to localhost for HaRP

Open Beginner friendly
#14,870 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Documentation
Clarity
Clearly specified
Activity status
Quiet
Tech stack
docker
Domain
documentation

Research direction

Start with the DeployConfigurations documentation section linked in the issue and compare its HaRP docker run example with the linked HaRP README example. Update the documented port mappings to bind to localhost where appropriate, and confirm both examples consistently show the intended secure defaults.

Written by the indexing model from the issue text.

Description

0. needs triage
Before You Submit
  • I have checked for existing issues and pull requests related to my suggestion.
  • I have posted on the Nextcloud Community Help Forum if my suggestion is a troubleshooting scenario or I'm unsure about the solution.
Type of Suggestion

Suggesting an improvement

Relevant Documentation Links

https://docs.nextcloud.com/server/stable/admin_manual/exapps_management/DeployConfigurations.html#nextcloud-and-docker-on-the-same-host-with-nextcloud-bare-metal

Summary

The docker run command for HaRP should show a binding to localhost only by default (improves security)

Details

Both https://docs.nextcloud.com/server/stable/admin_manual/exapps_management/DeployConfigurations.html#nextcloud-and-docker-on-the-same-host-with-nextcloud-bare-metal and https://github.com/nextcloud/HaRP#basic-docker-deployment show a docker run command for Nextcloud HaRP like this (Nextcloud and Docker on the same host - with Nextcloud bare metal):

docker run \
  -e HP_SHARED_KEY="some_very_secure_password" \
  -e NC_INSTANCE_URL="https://127.0.0.1:8080" \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v `pwd`/certs:/certs \
  --name appapi-harp -h appapi-harp \
  --restart unless-stopped \
  -p 8780:8780 \
  -p 8782:8782 \
  -d ghcr.io/nextcloud/nextcloud-appapi-harp:release

This binds both port 8780 and 8782 to all interfaces of the docker host, which is not needed in this case.

Since only locally running processes need to access the HaRP container, I would propose the following to tighten security:

docker run \
  -e HP_SHARED_KEY="some_very_secure_password" \
  -e NC_INSTANCE_URL="https://127.0.0.1:8080" \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v `pwd`/certs:/certs \
  --name appapi-harp -h appapi-harp \
  --restart unless-stopped \
  -p 127.0.0.1:8780:8780 \
  -p 127.0.0.1:8782:8782 \
  -d ghcr.io/nextcloud/nextcloud-appapi-harp:release
Additional Notes

@oleksandr-nc might be able to judge this

Dominant language
JavaScript
Stars
628
Forks
2.5k
Avg merge
1d 23h
Merged PRs (30d)
133

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nextcloud/documentation

All issues in nextcloud/documentation

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.