From 4155cefdf5e5224295302fa1dcf228f13b47d821 Mon Sep 17 00:00:00 2001 From: archipelago Date: Fri, 7 Aug 2026 19:00:29 -0400 Subject: [PATCH] docs(security): genericize a node address in the RPC-proxy incident record MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BITCOIN-RPC-PROXY-EXPOSURE.md's port claims verify against code (Bitcoin RPC on 127.0.0.1:8332, the bitcoin-ui proxy on 127.0.0.1:8334). But its incident narrative named a specific node's LAN address (192.168.63.240, five times) on a subnet the earlier 192.168.1.x sweep did not cover. Replaced with the RFC 5737 documentation address 192.0.2.240. The incident content — the exposure, the probes, the fix — is unchanged and remains a legitimate public security record. Co-Authored-By: Claude Opus 5 (1M context) --- docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md b/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md index 0deb6b9c..50750f60 100644 --- a/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md +++ b/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md @@ -25,9 +25,9 @@ cookies, no credentials: | Probe | Result | |---|---| -| `GET http://192.168.63.240:18083/lnd-connect-info` | `401`, 24 bytes, `{"error":"Unauthorized"}` — **closed** | -| `POST http://192.168.63.240:8334/bitcoin-rpc/` (`getblockcount`) | `200` — `{"result":960774,"error":null}` — **OPEN** | -| `OPTIONS http://192.168.63.240:8334/bitcoin-rpc/` | `204` with `Access-Control-Allow-Origin: *` — **OPEN** | +| `GET http://192.0.2.240:18083/lnd-connect-info` | `401`, 24 bytes, `{"error":"Unauthorized"}` — **closed** | +| `POST http://192.0.2.240:8334/bitcoin-rpc/` (`getblockcount`) | `200` — `{"result":960774,"error":null}` — **OPEN** | +| `OPTIONS http://192.0.2.240:8334/bitcoin-rpc/` | `204` with `Access-Control-Allow-Origin: *` — **OPEN** | The rendered config on disk, `/var/lib/archipelago/bitcoin-ui/nginx.conf`, was dated **2026-06-30** — the pre-fix version, with no `auth_request` and with the wildcard CORS @@ -88,7 +88,7 @@ Sequence, from file mtimes, container start times and the daemon journal: | 18:33 | Probe: `POST /bitcoin-rpc/` → `200` with a real block height. Exposure confirmed live. | | 18:36 | A **separate rebuild of bitcoin-ui**, done outside this work, rendered the fixed conf and recreated `archy-bitcoin-ui`. `:8334` closes here. | | 19:06 | The binary carrying `f6b5245b` is installed and the daemon restarted. | -| 19:12 | Probe: `POST /bitcoin-rpc/` → `401`. `OPTIONS` now returns `Access-Control-Allow-Origin: http://192.168.63.240:8334`, not `*`. | +| 19:12 | Probe: `POST /bitcoin-rpc/` → `401`. `OPTIONS` now returns `Access-Control-Allow-Origin: http://192.0.2.240:8334`, not `*`. | So the node is closed, and the fixed template is proven to work end to end on real hardware — but **the reconcile fix itself was never exercised.** By the time it was @@ -118,7 +118,7 @@ which mechanism produced it. | 2 | Probe with no cookies | `POST /bitcoin-rpc/` → **`200`**, `{"result":960790}`; `Allow-Origin: *`. **Genuinely re-exposed** | | 3 | Start the daemon (20:00:36) and touch nothing further | — | | 4 | Reconcile pass at **20:02:19** | `bitcoin_ui: nginx.conf rendered auth_hash=51f2b5af`, then `WARN prod_orchestrator: rewrote config for a user-uninstalled app whose container is still RUNNING (systemd/Quadlet keeps it alive independently of reconcile) — restarting so it picks the new config up app_id=bitcoin-ui container=archy-bitcoin-ui` | -| 5 | Probe again | `POST /bitcoin-rpc/` → **`401`**; `Allow-Origin: http://192.168.63.240:8334` | +| 5 | Probe again | `POST /bitcoin-rpc/` → **`401`**; `Allow-Origin: http://192.0.2.240:8334` | | 6 | Compare state | Conf **byte-identical** to the pre-test known-good; container healthy | Step 2 is what makes steps 4–6 mean anything: without a confirmed `200`, the later `401`