---
created: '2026-04-16T00:45:34+00:00'
id: fd7ea587-115c-4dfd-85d6-64a71da67f98
keywords:
- DNS amplification
- hardcoded secrets
- plaintext credentials
- no firewall
- no health checks
- no resource limits
- no monitoring
- traefik debug
- portainer outdated
- rustdesk outdated
- UTM stale
links: []
modified: '2026-04-16T00:45:34+00:00'
summary: All 23 security and quality issues found during the ana-colo infrastructure
  survey on 2026-04-15, organized by severity with remediation notes.
tags:
- infrastructure
- ana-colo
- security
- issues
- remediation
title: Ana Colo — Security and Quality Issues
---

# Ana Colo — Security and Quality Issues

> **Survey date:** 2026-04-15
> **Total findings:** 23 (3 critical, 7 medium, 13 low)

---

## 🔴 Critical

### 1. DNS exposed to the internet (FortiGate policy 61)

- **Policy:** wan1 → internal DNS ALLOW ALL
- **Risk:** DNS amplification attack vector — anyone on the internet can query the internal DNS resolver
- **Fix:** Restrict DNS source to internal zones and known VPN subnets only

### 2. Hardcoded secrets in Docker compose files

- **Affected files:**
  - `synapse/compose.yaml` — Postgres password
  - `seafile/compose.yaml` — MySQL root password (also duplicated in .env)
  - `gitea/compose.yaml` — DB password
- **Risk:** Secrets committed to git, visible to anyone with compose file access
- **Fix:** Move all secrets to `.env` files with 600 permissions; never commit secrets to version control

### 3. Plaintext secrets in config files

- **Affected files:**
  - `synapse/homeserver.yaml` — DB password, registration secret, macaroon key, form secret, appservice tokens
  - `mattermost/config.json` — SendGrid API key, SMTP password, encryption keys, salts
  - `mailrise/mailrise.conf` — SendGrid API key, Mattermost webhook tokens
- **Risk:** Credentials stored in version-controllable files, exposed to anyone with read access
- **Fix:** Externalize to `.env` or a secrets manager; add config files to `.gitignore`

---

## 🟡 Medium

### 4. Disabled but present ollama VIP + open policy

- **Details:** VIP "ollama-in" is disabled (good) but firewall policy 31 still allows :11434 from WAN
- **Fix:** Remove both the VIP and the policy

### 5. WebDAV without TLS

- **Details:** Port 8444 to NAS — raw TCP; NAS may not serve TLS
- **Fix:** Route through Traefik for TLS termination, or verify NAS is serving TLS

### 6. No health checks on most services

- **Details:** 13 of 20 containers have no health checks configured
- **Fix:** Add `healthcheck` directives to all compose files

### 7. No resource limits on any container

- **Details:** 20 containers sharing 16GB RAM with no memory or CPU limits
- **Fix:** Add `deploy.resources.limits` to all compose files

### 8. No monitoring stack

- **Details:** No Prometheus, Grafana, Loki, or log aggregation deployed
- **Fix:** Deploy monitoring (separate task)

### 9. No backup automation visible

- **Details:** Restic server exists but no client backup jobs found
- **Fix:** Define and deploy backup schedules for all critical data

### 10. FortiGate UTM features stale

- **Details:** Virus DB: 2018, IPS DB: 2015
- **Fix:** Update subscriptions or confirm this is intentional

---

## 🟢 Low

### 11. Traefik debug logging in production

- **Details:** `--log.level=DEBUG` is running in production
- **Fix:** Set to INFO or WARN

### 12. Traefik dashboard unprotected on :8380

- **Fix:** Add basic auth or restrict to internal sources

### 13. Stale commented-out configs in traefik.yml

- **Details:** Old Route53 DNS challenge, multiple cert resolvers
- **Fix:** Clean up

### 14. Portainer CE 3 years old + agent 2 years old

- **Fix:** Update images or remove (Dockge is the replacement)

### 15. RustDesk image 13 months old

- **Fix:** Update image

### 16. IT Tools image 13 months old

- **Fix:** Update image

### 17. Dockge backup uses untagged custom image (9392b1d81976)

- **Fix:** Tag the image or document its source

### 18. Firewall policy named "DELETE"

- **Details:** Policy 50: internal → mgmt ALLOW ALL
- **Fix:** Remove or rename

### 19. Redundant firewall policies

- **Details:** Policies 1 and 6 both do internal → wan1 ALLOW ALL
- **Fix:** Consolidate into a single policy

### 20. wan2 has no IP (DHCP failed/disabled)

- **Fix:** Configure the interface or disable it

### 21. Inconsistent restart policies across stacks

- **Details:** Some use `unless-stopped`, some have none
- **Fix:** Standardize to `unless-stopped`

### 22. No logging configuration on any container

- **Fix:** Add logging driver options (`max-size`, `max-file`)

### 23. Several services exposed on direct ports instead of through Traefik

- **Affected:** SillyTavern :8100, Open WebUI :3100, Dockge :5001, Portainer :9000/:9001, IT Tools :8780, Mailrise :8025
- **Note:** Some may be intentional (admin tools). Document the reason for each or add Traefik routing.