Despite carefully setting permissions on user accounts, I found that I had not locked things down, because caddy had administration open locally over HTTP without authentication.
So if I'm making an IDE-like tool, I really should be using docker.
I played around with Docker and found that with ufw I could pick which ports are available to Docker. This way I can make the postgres database available to Docker, but not Caddy or RabbitMQ or some other HTTP administration API.
Despite carefully setting permissions on user accounts, I found that I had not locked things down, because caddy had administration open locally over HTTP without authentication.
So if I'm making an IDE-like tool, I really should be using docker.
I played around with Docker and found that with ufw I could pick which ports are available to Docker. This way I can make the postgres database available to Docker, but not Caddy or RabbitMQ or some other HTTP administration API.