Merge pull request #524 from trails-cool/sec-caddy-admin

security: bind Caddy admin API to loopback (split metrics to :2020)

infrastructure/caddy/Caddyfile

@@ -1,6 +1,17 @@
 {
-	metrics
-	admin 0.0.0.0:2019
+	# Admin API on loopback only. It can reconfigure the proxy, so it must
+	# not be reachable by other containers on the Docker network (a journal
+	# / planner RCE could otherwise rewrite routes). Reloads run in-container
+	# (`docker compose exec caddy caddy reload`) over this loopback endpoint,
+	# matching infrastructure/brouter-host/Caddyfile.
+	admin localhost:2019
+}
+
+# Read-only Prometheus metrics on a dedicated network-reachable port,
+# split off the admin endpoint above so scraping doesn't require exposing
+# the admin API. Prometheus scrapes caddy:2020 (see prometheus.yml).
+:2020 {
+	metrics /metrics
 }
 
 (security_headers) {

infrastructure/prometheus/prometheus.yml

@@ -41,7 +41,9 @@ scrape_configs:
 
   - job_name: "caddy"
     static_configs:
-      - targets: ["caddy:2019"]
+      # Caddy's admin API is loopback-only; metrics are served on a
+      # dedicated port (see infrastructure/caddy/Caddyfile).
+      - targets: ["caddy:2020"]
 
   # Self-monitoring. Prometheus did not scrape its own /metrics, so TSDB
   # health (compaction failures, WAL corruption, head series, retention