fix(security): stop publishing the API to the internet in cleartext

compose.prod.yml

@@ -5,8 +5,11 @@ services:
     restart: unless-stopped
     networks:
       - cloudflare
+    # Loopback only: the tunnel reaches this container over the cloudflare
+    # network by name, so publishing to 0.0.0.0 only exposed the API to the
+    # internet in cleartext, past the proxy.
     ports:
-      - "14372:8080"
+      - "127.0.0.1:14372:8080"
     environment:
       DATABASE_URL: ${DATABASE_URL}
       JWT_SECRET: ${JWT_SECRET}

infra/oci/network.tf

@@ -30,6 +30,9 @@ resource "oci_core_default_route_table" "main" {
   }
 }
 
+# The API is not published here: traffic arrives through the tunnel, whose
+# connector dials out. An ingress rule for 14372 exposed it to the internet in
+# cleartext, past Cloudflare.
 resource "oci_core_default_security_list" "main" {
   compartment_id             = "ocid1.tenancy.oc1..aaaaaaaa33dfprecs3tmxiz3romtjrqadraiopzl3dbol5y2yii7kyvwgbya"
   display_name               = "Default Security List for vcn-20231117-1841"
@@ -74,17 +77,6 @@ resource "oci_core_default_security_list" "main" {
       min = 22
     }
   }
-  ingress_security_rules {
-    description = "TermForge"
-    protocol    = "6"
-    source      = "0.0.0.0/0"
-    source_type = "CIDR_BLOCK"
-    stateless   = false
-    tcp_options {
-      max = 14372
-      min = 14372
-    }
-  }
 }
 
 resource "oci_core_subnet" "main" {