From 1ee99ffc2c303a8106a226372b3c6e8f77c1037a Mon Sep 17 00:00:00 2001
From: asepharyana <superaseph@gmail.com>
Date: Wed, 22 Jul 2026 18:20:11 +0700
Subject: [PATCH] fix(infra): restrict Docker API proxy to whitelist only

---
 infra/dashboard/nginx.conf | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/infra/dashboard/nginx.conf b/infra/dashboard/nginx.conf
index 0d4393a..442fbff 100644
--- a/infra/dashboard/nginx.conf
+++ b/infra/dashboard/nginx.conf
@@ -66,13 +66,26 @@ http {
             proxy_read_timeout 5s;
         }
 
-        # Docker API proxy (read-only Unix socket)
-        location /api/docker/ {
-            proxy_pass http://unix:/var/run/docker.sock:/;
+        # Docker API proxy — strict whitelist (read-only Unix socket)
+        # Uses exact match (=) to avoid regex+proxy_pass URI limitation.
+        location = /api/docker/containers/json {
+            proxy_pass http://unix:/var/run/docker.sock:/containers/json;
             proxy_set_header Host $host;
             proxy_read_timeout 10s;
         }
 
+        location = /api/docker/version {
+            proxy_pass http://unix:/var/run/docker.sock:/version;
+            proxy_set_header Host $host;
+            proxy_read_timeout 10s;
+        }
+
+        # Deny all other Docker API access
+        location /api/docker/ {
+            deny all;
+            return 403;
+        }
+
         # Static files
         location / {
             try_files $uri $uri/ /index.html;