Version:

• listmonk: latest
• Deployment: Docker

Description of the bug and steps to reproduce:

By default, the docker-compose.yml configuration exposes PostgreSQL to all network interfaces (0.0.0.0:5432), which can lead to unauthorized access if not secured properly.

Steps to reproduce:

1. Deploy Listmonk using the default docker-compose.yml.
2. Run the following command to check PostgreSQL's exposure:

   sudo netstat -tulnp | grep 5432
   

Proposed Fix:

Modify docker-compose.yml to explicitly bind PostgreSQL to localhost:

ports:
   - "127.0.0.1:5432:5432"  # Restrict to localhost

After applying this change, restart the services:

docker-compose down
docker-compose up -d

Security Verification

Run:

sudo netstat -tulnp | grep 5432

Expected output:

tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN