Aias00 opened a new pull request, #4258: URL: https://github.com/apache/hertzbeat/pull/4258
## Summary Security hardening for the `hertzbeat-postgresql-greptimedb` quick-start compose bundle. The Postgres and GreptimeDB data-store ports were mapped to `0.0.0.0` (all interfaces). Both services run with **default credentials shipped in the compose file**: - `POSTGRES_PASSWORD: 123456` - greptime static user provider `greptime=greptime` Binding those ports to `0.0.0.0` lets any host that can reach the machine authenticate to the underlying data stores using only those published defaults. ## Fix Bind the host-side port mappings to `127.0.0.1`. The `hertzbeat` container reaches both data stores over the internal compose network (`hertzbeat` network, service DNS names `postgresql` / `greptime`) and does not need these host mappings at all — they exist only for the operator to inspect the data stores from the host, so localhost binding preserves that use case. - `127.0.0.1:15432:5432` (postgres) - `127.0.0.1:14000-14003:4000-4003` (greptime) The hertzbeat web/collector ports (`1157`/`1158`) are intentionally left unchanged. ## Out of scope (noted, not addressed here) The default credentials themselves remain in the bundle for quick-start ergonomics. Operators should still override `POSTGRES_PASSWORD` / the greptime user provider in production. Binding to localhost is the robust mitigation against remote use of those defaults. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
