Security Enhancement

apps/api/src/index.ts

@@ -7,12 +7,21 @@ import { createClient } from "redis";
 import { logger } from "./logger";
 import { type DeployJob, deployJobSchema } from "./schema";
 import { deploy } from "./utils";
+import rateLimit from "express-rate-limit";
 
 const app = new Hono();
 const redisClient = createClient({
 	url: process.env.REDIS_URL,
 });
 
+const limiter = rateLimit({
+	windowMs: 15 * 60 * 1000, // 15 minutes
+	max: 100, // limit each IP to 100 requests per windowMs
+	message: "Too many requests from this IP, please try again later.",
+});
+
+app.use(limiter);
+
 app.use(async (c, next) => {
 	if (c.req.path === "/health") {
 		return next();
@@ -57,5 +66,6 @@ const queue = new Queue({
 })();
 
 const port = Number.parseInt(process.env.PORT || "3000");
+const host = process.env.EXPOSE_ALL_INTERFACES === "true" ? "0.0.0.0" : "127.0.0.1";
 logger.info("Starting Deployments Server ✅", port);
-serve({ fetch: app.fetch, port });
+serve({ fetch: app.fetch, port, host });

apps/dokploy/.env.example

@@ -1,3 +1,4 @@
 DATABASE_URL="postgres://dokploy:amukds4wi9001583845717ad2@localhost:5432/dokploy"
 PORT=3000
-NODE_ENV=development
+NODE_ENV=development
+EXPOSE_ALL_INTERFACES=false

apps/dokploy/components/dashboard/settings/web-server.tsx

@@ -8,12 +8,14 @@ import {
 import { cn } from "@/lib/utils";
 import { api } from "@/utils/api";
 import { useTranslation } from "next-i18next";
-import React from "react";
+import React, { useState } from "react";
 import { ShowDokployActions } from "./servers/actions/show-dokploy-actions";
 import { ShowStorageActions } from "./servers/actions/show-storage-actions";
 import { ShowTraefikActions } from "./servers/actions/show-traefik-actions";
 import { ToggleDockerCleanup } from "./servers/actions/toggle-docker-cleanup";
 import { UpdateServer } from "./web-server/update-server";
+import { Switch } from "@/components/ui/switch";
+import { Alert } from "@/components/ui/alert";
 
 interface Props {
 	className?: string;
@@ -24,6 +26,14 @@ export const WebServer = ({ className }: Props) => {
 
 	const { data: dokployVersion } = api.settings.getDokployVersion.useQuery();
 
+	const [exposeAllInterfaces, setExposeAllInterfaces] = useState(
+		process.env.EXPOSE_ALL_INTERFACES === "true"
+	);
+
+	const handleToggleChange = () => {
+		setExposeAllInterfaces(!exposeAllInterfaces);
+	};
+
 	return (
 		<Card className={cn("rounded-lg w-full bg-transparent p-0", className)}>
 			<CardHeader>
@@ -53,6 +63,22 @@ export const WebServer = ({ className }: Props) => {
 
 					<ToggleDockerCleanup />
 				</div>
+
+				<div className="flex items-center justify-between gap-4">
+					<span className="text-sm text-muted-foreground">
+						Expose server port
+					</span>
+					<Switch
+						checked={exposeAllInterfaces}
+						onCheckedChange={handleToggleChange}
+					/>
+				</div>
+
+				{exposeAllInterfaces && (
+					<Alert variant="warning">
+						{t("settings.server.webServer.exposeWarning")}
+					</Alert>
+				)}
 			</CardContent>
 		</Card>
 	);

apps/dokploy/server/server.ts

@@ -28,6 +28,7 @@ const app = next({ dev, turbopack: process.env.TURBOPACK === "1" });
 const handle = app.getRequestHandler();
 void app.prepare().then(async () => {
 	try {
+		const host = process.env.EXPOSE_ALL_INTERFACES === "true" ? "0.0.0.0" : "127.0.0.1";
 		const server = http.createServer((req, res) => {
 			handle(req, res);
 		});
@@ -63,7 +64,7 @@ void app.prepare().then(async () => {
 			await migration();
 		}
 
-		server.listen(PORT);
+		server.listen(PORT, host);
 		console.log("Server Started:", PORT);
 		if (!IS_CLOUD) {
 			console.log("Starting Deployment Worker");