From 6b2aaee75606e6419b40762193f1577b97966690 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 20 Jul 2026 18:32:40 +0000
Subject: [PATCH] wolf-pair: don't expose the pairing UI publicly when Caddy
 fronts it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

wolf-pair has no login of its own — Authelia via Caddy is the only
protection option offered for it — but UFW opened its port to the
whole internet unconditionally, before the Caddy/Authelia prompt even
ran. Same gap just fixed for the Asterisk web admin: reachable
straight over the bare port regardless of Authelia.

Reordered so the Caddy decision happens first, and scope the port to
caddy_net's subnet via ufw_allow_from_caddy_net() instead of leaving
it open to 0.0.0.0/0 when Caddy fronts it locally. Also enables UFW
via ensure_ufw_enabled() like the Asterisk services.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015X1jRGHwrvovz2qkhKfDZi
---
 services/wolf-pair.sh | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/services/wolf-pair.sh b/services/wolf-pair.sh
index a7a94a1..a874b9a 100644
--- a/services/wolf-pair.sh
+++ b/services/wolf-pair.sh
@@ -422,13 +422,11 @@ COMPOSE
 
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$WOLFPAIR_DIR"
 
-    # ── 4. Firewall ───────────────────────────────────────────────────────────
-    if command -v ufw &>/dev/null; then
-        ufw allow "${WOLFPAIR_PORT}/tcp" comment "wolf-pair pairing UI" >/dev/null 2>&1 || true
-        log_success "UFW: opened port $WOLFPAIR_PORT/tcp"
-    fi
-
-    # ── 5. Caddy (optional) ───────────────────────────────────────────────────
+    # ── 4. Caddy (optional) ───────────────────────────────────────────────────
+    # Decided before the firewall rule below: wolf-pair has no login of its
+    # own (that's the whole reason to offer Authelia here), so if Caddy ends
+    # up fronting it locally, the UFW rule must not also leave the bare port
+    # open to the internet — that would bypass Authelia entirely.
     local WOLFPAIR_EXTRA_BLOCK=""
     if [ -d "$DOCKER_DIR/authelia" ]; then
         local _use_auth=""
@@ -437,6 +435,18 @@ COMPOSE
     fi
     configure_caddy_for_service "wolf-pair" "$WOLFPAIR_PORT" "wolf-pair" "$WOLFPAIR_EXTRA_BLOCK"
 
+    # ── 5. Firewall ───────────────────────────────────────────────────────────
+    if command -v ufw &>/dev/null; then
+        if [[ "$CADDY_SERVICE_CONFIGURED" == true && "$CADDY_SERVICE_MODE" == "local" ]]; then
+            ufw delete allow "${WOLFPAIR_PORT}/tcp" 2>/dev/null || true
+            ufw_allow_from_caddy_net "${WOLFPAIR_PORT}"
+        else
+            ufw allow "${WOLFPAIR_PORT}/tcp" comment "wolf-pair pairing UI" >/dev/null 2>&1 || true
+            log_success "UFW: opened port $WOLFPAIR_PORT/tcp"
+        fi
+        ensure_ufw_enabled
+    fi
+
     # ── 6. README ─────────────────────────────────────────────────────────────
     write_readme "$WOLFPAIR_DIR" << 'MD'
 # wolf-pair