← Dashboard

🔐 Security Overview

BrinkBox1 · Restricted — LAN & Tailscale VPN only

✓ You have restricted access

Your IP: loading… · Access path: loading…

Network Exposure

🌐 Tailscale Funnel
Status Loading…
Public URL brinkbox1.tail4dec02.ts.net
Exposed target http://127.0.0.1:9000
TTL / Expires —
checking
🔒 Tailscale VPN
Status Active
VPN IP 100.98.121.102
Hostname brinkbox1.tail4dec02.ts.net
Funnel port 443 (HTTPS)
VPN Active
⚠️ Firewall
UFW Not active / not installed
iptables Docker-managed only
All ports Bound to 0.0.0.0
No host firewall

LAN protection only. Tailscale VPN + Funnel controls public access.

Listening Ports & Exposure Level

🗄️ Public-facing (0.0.0.0)
9000Dashboard nginxFunnel-exposed
8080EduReach App LAN only
5000Flask API LAN only
5432PostgreSQL 0.0.0.0 — restrict!
5050Sandbox Flask LAN only
9092Sandbox UI LAN only
8081cAdvisor LAN only
22SSH LAN only
📡 Monitoring (0.0.0.0 / *)
3000Grafana LAN only
9090Prometheus LAN only
9100Node Exporter LAN only
443Tailscale HTTPS 100.98.121.102 only
🚨 Attention Items
PostgreSQL :5432 Bound to 0.0.0.0
Postgres is reachable from the LAN. Only accessible externally via Tailscale VPN — no public exposure currently.

Recommended: add 127.0.0.1:5432:5432 to docker-compose to limit binding to localhost.

Access Control Summary

✅ This page
nginx rule allow 10.0.0.0/24 + 100.64.0.0/10
Public funnel ❌ Blocked
Layer nginx (network layer)
✅ Sharing Controls
nginx rule allow 10.0.0.0/24 + 100.64.0.0/10
API layer Flask IP check + admin token
Rate limit 5s cooldown per toggle
🔧 Quick Hardening Tips
1. sudo ufw enable → restrict :5432, :5000
2. Bind Postgres to 127.0.0.1 in compose
3. Set DASH_ADMIN_TOKEN before using sharing toggle
4. Disable Funnel when demo is done
5. Review tailscale serve status regularly

BrinkBox1 Security Page · Restricted access · Last loaded