Security Audit — Initial State

Summary

On 2026-05-25, a ss -tlnp audit revealed that 11 internal services were bound to 0.0.0.0 (all network interfaces), making them reachable from the public internet. Only SSH (22), HTTP (80), and HTTPS (443) should be public.

Services Exposed to `0.0.0.0`

Port	Service	Process	Risk
6379	Redis / Valkey	docker-proxy (orctadocsmcp-valkey-1)	Critical — no auth, database cache
5433	PostgreSQL	docker-proxy (orctadocsmcp-postgres-1)	Critical — full database access
6432	pgBouncer	docker-proxy (orcta_pgbouncer)	Critical — database connection pooler
11434	Ollama	ollama serve	High — unrestricted LLM API
8000	Python MCP Server	python -m mcpserver.server	High — internal doc retrieval API
3001	Chart Server	docker-proxy (mentorship-services-chartserver)	Medium — WebSocket + API
9393	Mentorship Backend	docker-proxy (mentorship-services-backend)	Medium — mentorship platform API
9292	Orcta Stack Backend	docker-proxy (orcta-stack-backend-1)	Medium — core stack API
9696	Deno App	docker-proxy (deno-app)	Medium — email ping service
9999	PSS Backend	docker-proxy (orcta-backend-pss)	Medium — PSS API
4983	Drizzle Gateway	docker-proxy (drizzle-gate)	Medium — database gateway

Caddyfile Security Headers Gap

Site	HSTS	XFO	XCTO	Referrer-Policy	Permissions-Policy
api.pss.orctatech.com	✅	✅	✅	✅	❌
career.orctatech.com	✅	✅	✅	✅	❌
mentorship.orctatech.com	✅	✅	✅	✅	❌
email-ping.orctatech.com	✅	✅	✅	✅	❌
ai.orctatech.com	✅	✅	✅	✅	❌
bot.orctatech.com	✅	✅	✅	✅	❌
orc-mcp.orctatech.com	✅	✅	✅	✅	❌
files.ames.orctatech.com	✅	❌	❌	❌	❌
waybills.orctatech.com	❌	❌	❌	❌	❌
api.waybills.orctatech.com	❌	❌	❌	❌	❌
ames.orctatech.com	❌	❌	❌	❌	❌
api.ames.orctatech.com	❌	❌	❌	❌	❌
pss.orctatech.com	❌	❌	❌	❌	❌

SSH Exposure

SSH was listening on 0.0.0.0:22 via systemd socket activation (ssh.socket), reachable from the entire internet. Authentication relied solely on SSH keys (PasswordAuthentication no), but the attack surface was unnecessarily large.

Tailscale

The VPS was connected to a personal Tailscale (Adjanour@) with --advertise-exit-node, but this was underused — all traffic still went over the public IP.

Edit this page

Last modified: 2026-08-03