search

laravel / octane

Supercharge your Laravel application's performance.
https://laravel.com/docs/octane
MIT License
3.74k stars 291 forks source link

Listen Caddy admin port on all interfaces #817

Closed smortexa closed 7 months ago

smortexa commented 7 months ago

Currently, Caddy admin APIs are not accessible from outside of container. This PR allows accessing Caddy admin APIs inside a container by listening on all interfaces.

francislavoie commented 7 months ago

No, this is a very bad idea.

The admin endpoint should never be publicly accessible. Otherwise, an attacker could change your server's config and make it do whatever they want.

Many servers don't have firewalls blocking all ports by default, so listening to all interfaces here would be a huge security vulnerability (essentially a guarantee that your server will be compromised).

What you should do if you need to access the admin API is to change your Caddyfile yourself (copy it and modify it). Or alternatively you can use an SSH tunnel to access it (which can mimic the client being on the same machine).

mholt commented 7 months ago

If the admin endpoint is opened up publicly, you should at least configure mTLS authentication to protect it.

smortexa commented 7 months ago

So, I think I probably should communicate with Caddy admin APIs (such as /metrics) through Laravel.

francislavoie commented 7 months ago

Or use the metrics directive to expose it on any site in Caddy: https://caddyserver.com/docs/caddyfile/directives/metrics