Security

What you should do

• Keep .env private (chmod 600 .env); it contains the database password and is never part of the repository.
• Use a random database password (openssl rand -hex 24), set before the first start (see Installation). The backend warns in its log (SECURITY: …) when the password from .env.example, the old default or one shorter than 16 characters is used.
• Set UPDATE_REQUIRE_SIGNED=true in .env, so only signed releases are installed (see Updates).
• Do not open ports 8080, 4000 or 8081 in the firewall (see Installation, step 7). Keep PUBLISH_ADDR=127.0.0.1 when a reverse proxy serves the domains: ports published by Docker or Podman bypass ufw.
• Restrict the admin domain further (VPN, IP allow-list or HTTP basic auth) if only a few people need it (examples in Installation with Podman#7-caddy-as-reverse-proxy and Own Reverse Proxy).
• Backups contain customer data, password hashes and your payment/email keys: keep the backup repository private and turn on two-factor authentication for your GitHub account (see Backups).
• Only restore backups you made yourself (see Restoring a Backup).

What the shop does by itself

Containers

• The database is on its own internal network (db_net): only the backend can reach it, and it has no internet access. Storefront, admin and the proxy cannot even resolve its name.
• Backend (user shop, uid 10001), storefront and admin (user node) run without root rights, with all capabilities dropped that they don't need. Log files are limited to 10 MB per file.
• NO_NEW_PRIVILEGES=true additionally stops programs from gaining privileges through setuid binaries. Recommended with Docker; leave it false with Podman on AppArmor systems (Debian, Ubuntu), where it stops PostgreSQL from starting.

Database

• Every database migration runs in one transaction: a failing update can never leave a half-changed database.
• Restoring a backup runs only SQL: psql runs in restricted mode, so a backup file that contains psql commands (which could start programs on the server) is refused and nothing is changed.

Updates

• The updater service can control Docker/Podman on the host (that is how it rebuilds the shop). It has no published port, is only reachable by the backend over a private network and requires a token generated on first start. Remove the updater service from docker-compose.yml if you prefer updating manually.
• It installs only releases signed with a key that the installed version trusts (deploy/updater/allowed_signers), backs up the database first (only root can read these dumps; the last 10 are kept) and goes back to the previous version when the shop does not come back healthy.
• Files the updater changes in the checkout are owned by root; use sudo for manual git commands in /opt/rustwebshop.

Reporting a vulnerability

Please don't open a public issue for security problems: report them privately to the maintainer (github.com/MrJSA). Leave out passwords, keys and customer data (see Reporting Issues).