From 5e4c60bb303994f217352763478f9753731e288b Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Sun, 14 Dec 2025 02:42:46 +0100
Subject: [PATCH] chore (security): port hardening, commented out non-critical
 ports

---
 adguardhome/compose.yaml |  2 +-
 authentik/compose.yaml   |  6 +++---
 homepages/compose.yaml   | 11 +++++------
 penpot/compose.yaml      |  4 ++--
 termix/compose.yaml      |  4 ++--
 uptime-kuma/compose.yaml |  4 ++--
 6 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/adguardhome/compose.yaml b/adguardhome/compose.yaml
index bbcd151..f423425 100644
--- a/adguardhome/compose.yaml
+++ b/adguardhome/compose.yaml
@@ -10,7 +10,7 @@ services:
       - "53:53/udp"
       # - "67:67/udp" # DHCP
       # - "68:68/tcp" # DHCP
-      - "3000:3000/tcp"
+      # - "3000:3000/tcp"
     volumes:
       - ./data/work:/opt/adguardhome/work
       - ./data/conf:/opt/adguardhome/conf
diff --git a/authentik/compose.yaml b/authentik/compose.yaml
index 537793d..a156025 100644
--- a/authentik/compose.yaml
+++ b/authentik/compose.yaml
@@ -26,9 +26,9 @@ services:
     command: server
     container_name: authentik-server
     restart: unless-stopped
-    ports:
-      - ${PORT_HTTP:-9000}:9000
-      - ${PORT_HTTPS:-9443}:9443
+    # ports:
+    #   - ${PORT_HTTP:-9000}:9000
+    #   - ${PORT_HTTPS:-9443}:9443
     env_file:
       - .env
     environment:
diff --git a/homepages/compose.yaml b/homepages/compose.yaml
index 6a246a4..58ca2cf 100644
--- a/homepages/compose.yaml
+++ b/homepages/compose.yaml
@@ -3,8 +3,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.forust
-    ports:
-      - "8085:80"
+    # ports:
+    #   - "8085:80"
     restart: unless-stopped
     volumes:
       - ./forust_files:/usr/share/nginx/html
@@ -42,8 +42,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.xdfnx
-    ports:
-      - "8086:80"
+    # ports:
+    #   - "8086:80"
     restart: unless-stopped
     volumes:
       - ./xdfnx_files:/usr/share/nginx/html
@@ -52,7 +52,7 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
-      
+
       # Services
       - "traefik.http.services.xdfnx-homepage.loadbalancer.server.port=80"
 
@@ -77,7 +77,6 @@ services:
       - "traefik.http.routers.xdfnx-dev.service=xdfnx-homepage"
       - "traefik.http.routers.xdfnx-dev.tls=true"
 
-
 networks:
   traefik-proxy:
     external: true
diff --git a/penpot/compose.yaml b/penpot/compose.yaml
index db2b1b1..46b47c4 100644
--- a/penpot/compose.yaml
+++ b/penpot/compose.yaml
@@ -86,8 +86,8 @@ services:
   penpot-frontend:
     image: "penpotapp/frontend:${PENPOT_VERSION:-latest}"
     restart: always
-    ports:
-      - 9001:8080
+    # ports:
+    #   - 9001:8080
 
     volumes:
       - penpot_assets:/opt/data/assets
diff --git a/termix/compose.yaml b/termix/compose.yaml
index 44a87c1..dbcd411 100644
--- a/termix/compose.yaml
+++ b/termix/compose.yaml
@@ -3,8 +3,8 @@ services:
     image: ghcr.io/lukegus/termix:latest
     container_name: termix
     restart: unless-stopped
-    ports:
-      - "3331:8080"
+    # ports:
+    #   - "3331:8080"
     volumes:
       - ./termix-data:/app/data
     environment:
diff --git a/uptime-kuma/compose.yaml b/uptime-kuma/compose.yaml
index 699ba79..1eff102 100644
--- a/uptime-kuma/compose.yaml
+++ b/uptime-kuma/compose.yaml
@@ -5,9 +5,9 @@ services:
     container_name: uptime-kuma
     volumes:
       - ./data:/app/data
-    ports:
+      # ports:
       # <Host Port>:<Container Port>
-      - "3001:3001"
+      # - "3001:3001"
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"