From b4a45a6735e0812e4d15e619c486b7b1b9e4edda Mon Sep 17 00:00:00 2001 From: ginnoir Date: Sun, 21 Jun 2026 14:46:22 -0500 Subject: [PATCH] fix: block public hermes browser UI --- Caddyfile | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/Caddyfile b/Caddyfile index 26e3cc8..6d47d7a 100644 --- a/Caddyfile +++ b/Caddyfile @@ -360,22 +360,18 @@ homarr.ginnoir.com { reverse_proxy homarr:7575 } -# Hermes Desktop remote backend. Browser UI is SSO-gated; API/WS paths -# are passed through so Desktop clients can authenticate with the Hermes -# dashboard session token instead of an Authentik browser cookie. +# Hermes Desktop remote backend. Only API/WS is exposed for native +# clients; the browser dashboard is blocked so its injected session token +# is not leaked to the public web. hermes.ginnoir.com { route { - import authentik_outpost handle /api/* { reverse_proxy 172.20.0.1:9119 { header_up Host 172.20.0.1:9119 } } handle { - import authentik_forward_auth - reverse_proxy 172.20.0.1:9119 { - header_up Host 172.20.0.1:9119 - } + respond "Hermes dashboard browser UI is disabled on this public hostname." 403 } } }