turvalisus: avalikud Docker-pordid -> loopback+Tailscale (tika, anythingllm, mcp-filesystem, liiklusatlas, reranker, flaresolverr, clickstack, openclaw)

dev/docker-compose.yml

@@ -116,9 +116,12 @@ services:
       - 'DEFAULT_CONNECTIONS=[{"name":"Local ClickHouse","host":"http://default:dev_clickhouse_2026@clickhouse:8123"}]'
     command: ["sh", "/clickstack-entry.sh"]
     ports:
-      - "18080:8080"   # HyperDX UI (search, dashboards)
-      - "4317:4317"    # OTLP gRPC (telemeetria sisend)
-      - "4318:4318"    # OTLP HTTP (telemeetria sisend)
+      - "127.0.0.1:18080:8080"
+      - "100.87.1.24:18080:8080"   # HyperDX UI
+      - "127.0.0.1:4317:4317"
+      - "100.87.1.24:4317:4317"
+      - "127.0.0.1:4318:4318"
+      - "100.87.1.24:4318:4318"
     volumes:
       - ./data/clickstack:/data
       - ./clickstack-entry.sh:/clickstack-entry.sh:ro
@@ -132,7 +135,8 @@ services:
     container_name: clickstack-proxy
     restart: unless-stopped
     ports:
-      - "8124:8124"
+      - "127.0.0.1:8124:8124"
+      - "100.87.1.24:8124:8124"
     volumes:
       - ./config/clickstack-proxy/nginx.conf:/etc/nginx/conf.d/clickstack.conf:ro
     depends_on:

main/docker-compose.yml

@@ -251,7 +251,8 @@ services:
     cpus: 3.0
     command: ["--model-id", "BAAI/bge-reranker-base", "--port", "80", "--max-concurrent-requests", "2", "--auto-truncate", "--max-batch-tokens", "2048", "--max-client-batch-size", "256"]
     ports:
-      - "8082:80"  # reranker
+      - "127.0.0.1:8082:80"  # reranker (loopback + Tailscale)
+      - "100.87.1.24:8082:80"
     volumes:
       - ./reranker-cache:/data
     environment:

third/server/anythingllm/docker-compose.yml

@@ -7,7 +7,8 @@ services:
     container_name: anythingllm
     restart: unless-stopped
     ports:
-      - "3002:3001"
+      - "127.0.0.1:3002:3001"
+      - "100.87.1.24:3002:3001"
     volumes:
       - /data/docker/anythingllm/storage:/app/server/storage
       - /data/docker/anythingllm/logs:/app/server/logs

third/server/flaresolverr/docker-compose.yml

@@ -6,7 +6,8 @@ services:
     container_name: flaresolverr
     restart: unless-stopped
     ports:
-      - "8191:8191"
+      - "127.0.0.1:8191:8191"
+      - "100.87.1.24:8191:8191"
     environment:
       - LOG_LEVEL=info
       - TZ=Europe/Tallinn

third/server/mcp-filesystem/docker-compose.yml

@@ -7,7 +7,7 @@ services:
     entrypoint: ["/entrypoint.sh"]
     command: ["/projects"]
     ports:
-      - "3100:3100"
+      - "127.0.0.1:3100:3100"
     environment:
       - TZ=Europe/Tallinn
       - LANG=C.UTF-8

third/server/openwebui/docker-compose.yml

@@ -137,7 +137,8 @@ services:
     image: apache/tika:latest-full     # "full" sisaldab Tesseract OCR-i (soovitatav)
     container_name: tika
     ports:
-      - "9998:9998"                     # Vajadusel väljapoole eksponeerimiseks
+      - "127.0.0.1:9998:9998"
+      - "100.87.1.24:9998:9998"                     # Vajadusel väljapoole eksponeerimiseks
     restart: unless-stopped
     environment:
       - TZ=Europe/Tallinn