security: same-origin console CORS, fail-closed helm creds, deny.toml, sample-config hardening (#2769)

Signed-off-by: Michael Graff <[email protected]> Signed-off-by: 安正超 <[email protected]> Co-authored-by: 安正超 <[email protected]> Co-authored-by: loverustfs <[email protected]>
2026-05-06 07:34:44 +00:00
parent 718bec7722
commit 3898d524fe
9 changed files with 373 additions and 42 deletions
@@ -33,6 +33,8 @@ services:
      - RUSTFS_CONSOLE_ADDRESS=0.0.0.0:9001
      - RUSTFS_CONSOLE_ENABLE=true
      - RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS=*
+      # SECURITY: these defaults are public and well-known. Override before
+      # exposing the listener beyond localhost.
      - RUSTFS_ACCESS_KEY=rustfsadmin
      - RUSTFS_SECRET_KEY=rustfsadmin
      - RUSTFS_OBS_LOGGER_LEVEL=info