Allow App Expose to localhost only

Feature Requests
1

Problem/Justification
Currently apps can only be exposed completly for external access or only in the same container. When using something like a reverse proxy on the same device you want to limit the access for localhost only so it isn’t completly exposed as it is not needed

Impact
Security Benefit since you can limit access to localhost. Currently only static IPs are able, but not 127.0.0.1

User Story
Small enhancement request started at github: truenas/apps/issues/5340

I am using nginx proxy manager and subdomains for every service to have valid certificates issued via Lets Encrypt. Therefore I want to expose the services only for nginx proxy manager which should be able if 127.0.0.1 would be allowed on the host.

Currently I have just limited my firewall for access to HTTPs, but other people, especially at home, running it maybe in the same subnet, so they can’t set firewall rules directly for it.

2

I don’t believe this would work as you expect it to. Each app is in its own container with its own internal IP address, so, e.g., Sonarr wouldn’t see traffic from NPM as coming from localhost.

The way you’d handle this is by putting all the app containers, including your reverse proxy, on a separate Docker network (call it whatever you like; proxy is a common name). Then expose only 80/443 for your reverse proxy; set the Port Bind Mode to none for the other apps.

I know this is possible for custom Compose apps (I describe the process at Caddy | Dan's Wiki using Caddy); let me check how it would work with the apps system.

Here’s how you’d do this with the built-in apps system and NPM: