[Gl4dr3x]

Gap: docker-compose.custom.yml publishes rsshub on host port 1200 and real-browser on host port 3001, and carries the Basic Auth credential for RSSHub as a literal Traefik label value in a public repository. Nothing needs the host ports; the credential should not be in the file.

Change: rsshub and real-browser use expose (1200, 3000) instead of ports. The basicauth.users label keeps its middleware, so RSSHub stays protected, and takes its value from ${RSSHUB_BASIC_AUTH:?}, a Coolify environment variable. A deploy is blocked while the variable is empty, so the file cannot go out unprotected by omission.

Before merge, in Coolify:

1. Create a new password and set RSSHUB_BASIC_AUTH on the RSSHub app to the user:hash line from htpasswd -nbB <user> '<password>'. Do not reuse the previous password.
2. Deploy this branch as a test deployment.
3. Check that RSSHub answers 401 without credentials and 200 with them.
4. If the correct password gets 401, Compose probably expanded the $ signs of the hash; enter the hash with every $ doubled and redeploy.
5. Fetch one route that needs the stack's browsers (Puppeteer via browserless, and one using real-browser) to confirm the services still reach each other.
6. Check that nothing outside the stack called :1200 or :3001 on the host.

Unverified: The behavior of ${VAR:?} inside a label and the $ handling in Coolify's generated env file come from Coolify's documentation, not from a run. Nothing was run on a Docker host.

Out of scope: Git history still holds the old value; rotating the password in step 1 is what closes that.

Closes workoho/hostwarden-workspace#70. Refs workoho/hostwarden-workspace#28.

Verified: git diff reviewed; oxfmt not applied (config excludes *.yml from the hook). Pre-commit hook could not run on Windows here (no shebang, no node_modules), so the commit skipped it.

🤖 Generated with Claude Code

[Gl4dr3x]

Before the test deploy: the same approach was tried on 2026-04-01 (e65eef823, label value from ${TRAEFIK_BASICAUTH_USERS}) and replaced by a literal hash the same day (1de96550c, then 829d00728); the reason is not recorded. The likely cause is how Coolify writes the $ signs of the bcrypt hash into its env file. So the test deploy has to check both cases: the correct password gets 200, and no auth gets 401. If the correct password gets 401, enter the hash in Coolify with every $ doubled, as the pre-merge steps say.

An AI agent wrote this text in my name, on my instructions.