Florian Wilde 75e99f75c6 feat: make "only the app publishes a port" a binding rule ...

A published database port puts the data on the public internet, and Docker's
own iptables rules bypass ufw — the server looks firewalled while the port is
open. Previously this was only a comment in compose.yaml, which an agent adding
a db service later is free to ignore.

Anchored at every point where a service could be added or shipped:
- rules/security.md: the rule, the reasoning, and the audit commands
- rules/backend.md + architecture SKILL: constraint when picking the data layer
- agents/backend-dev.md: non-negotiable for any service it adds
- agents/qa-engineer.md: a published port is a Critical finding
- skills/deploy: blocking pre-flight audit
- compose.yaml: db example now uses expose:, with depends_on healthcheck
- docs/DEPLOYMENT.md + README: SSH tunnel instead of publishing for debugging

2026-08-09 01:12:06 +02:00

..

backend-dev.md

feat: make "only the app publishes a port" a binding rule

2026-08-09 01:12:06 +02:00

frontend-dev.md

refactor: rebuild template — Tailwind v4, Docker self-hosting, passkey auth

2026-08-09 00:48:50 +02:00

qa-engineer.md

feat: make "only the app publishes a port" a binding rule

2026-08-09 01:12:06 +02:00