fo

mnemo_cards_backend/PROGRESS.md

@@ -29,10 +29,11 @@
 
 **Security Features Added:**
 - ✅ IP address access blocking for both HTTP and HTTPS (only domain access allowed)
-- ✅ Automatic Forgejo ROOT_URL configuration fix
+- ✅ Direct port 3000 access blocking (Forgejo listens only on localhost)
+- ✅ Automatic Forgejo ROOT_URL and HTTP_ADDR configuration fix
 - ✅ SSL certificate validation for domain access
 - ✅ Service restart after configuration changes
-- ✅ Comprehensive testing for IP blocking and ROOT_URL validation
+- ✅ Comprehensive testing for all security measures
 
 **Next Action:** Run updated setup script on server to activate domain configuration with IP blocking and ROOT_URL fix
 

mnemo_cards_web_v2/deploy/fix-forgejo-config.sh

@@ -89,8 +89,19 @@ print_success "Config backed up to: $BACKUP_FILE"
 print_status "Updating ROOT_URL to https://code.mnemo-cards.online..."
 sed -i 's|^ROOT_URL.*=.*|ROOT_URL = https://code.mnemo-cards.online|' "$FORGEJO_CONFIG"
 
-# Verify change
+# Update HTTP_ADDR to listen only on localhost (for security)
+print_status "Updating HTTP_ADDR to listen only on localhost..."
+if grep -q "^HTTP_ADDR" "$FORGEJO_CONFIG"; then
+    sed -i 's|^HTTP_ADDR.*=.*|HTTP_ADDR = 127.0.0.1|' "$FORGEJO_CONFIG"
+else
+    # Add HTTP_ADDR if not present
+    sed -i '/^\[server\]/a HTTP_ADDR = 127.0.0.1' "$FORGEJO_CONFIG"
+fi
+
+# Verify changes
 NEW_ROOT_URL=$(grep -E "^ROOT_URL" "$FORGEJO_CONFIG" | cut -d'=' -f2 | tr -d ' ')
+NEW_HTTP_ADDR=$(grep -E "^HTTP_ADDR" "$FORGEJO_CONFIG" | cut -d'=' -f2 | tr -d ' ')
+
 if [ "$NEW_ROOT_URL" = "https://code.mnemo-cards.online" ]; then
     print_success "ROOT_URL updated successfully: $NEW_ROOT_URL"
 else
@@ -98,10 +109,17 @@ else
     exit 1
 fi
 
+if [ "$NEW_HTTP_ADDR" = "127.0.0.1" ]; then
+    print_success "HTTP_ADDR updated successfully: $NEW_HTTP_ADDR (localhost only)"
+else
+    print_error "Failed to update HTTP_ADDR!"
+    exit 1
+fi
+
 # Show the full [server] section for verification
 print_status "Current [server] section in config:"
 echo "----------------------------------------"
-sed -n '/^\[server\]/,/^\[/p' "$FORGEJO_CONFIG" | grep -E "(ROOT_URL|DOMAIN|HTTP_PORT|ROOT_PATH)"
+sed -n '/^\[server\]/,/^\[/p' "$FORGEJO_CONFIG" | grep -E "(ROOT_URL|HTTP_ADDR|DOMAIN|HTTP_PORT|ROOT_PATH)"
 echo "----------------------------------------"
 
 # Restart Forgejo/Gitea service

mnemo_cards_web_v2/deploy/test-forgejo-domain.sh

@@ -86,6 +86,15 @@ else
     print_warning "HTTPS IP access not blocked: $HTTPS_IP_BLOCK_STATUS (should be 444)"
 fi
 
+# Test that direct port 3000 access is blocked
+print_status "Testing that direct port 3000 access is blocked..."
+PORT_3000_STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 http://147.45.152.129:3000/)
+if [ "$PORT_3000_STATUS" = "000" ]; then
+    print_success "Direct port 3000 access blocked: $PORT_3000_STATUS ✓"
+else
+    print_warning "Direct port 3000 access not blocked: $PORT_3000_STATUS (should be connection failed)"
+fi
+
 # Test SSL certificate
 print_status "Testing SSL certificate..."
 SSL_INFO=$(openssl s_client -connect code.mnemo-cards.online:443 -servername code.mnemo-cards.online < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates 2>/dev/null)