fix(traefik): restrict default Dokploy route (#5036)

[9MidhunPM]

Fixes #5036.

Summary

The generated Dokploy fallback router is bound to Traefik's public web entrypoint and trusts the client-controlled Host: dokploy.docker.localhost header. That exposes the Dokploy UI through port 80 even when port 3000 is firewalled.

Fix

Adds a route-specific Traefik ipAllowList middleware to the default fallback router. It permits only loopback and RFC1918 IPv4 ranges:

• 127.0.0.1/32
• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

This preserves local/private default access while public requests are denied before they reach Dokploy.

Migration design

On startup, existing valid fallback configurations are reconciled unconditionally to Dokploy's canonical local-access middleware definition and router attachment. This avoids relying on presence-based correctness detection, which can miss malformed or permissive definitions under the Dokploy-owned middleware key. Both canonical fallback forms are reconciled: the generated Host(...) && PathPrefix(...) rule and the Host(...) rule produced when server settings select dokploy.docker.localhost.

Migration has two explicit skip categories:

• Cannot safely reconcile: unreadable or unparseable files, a non-object root, or invalid/missing HTTP router or middleware structure. The migration logs the reason, leaves the existing file untouched, and does not abort startup.
• Deliberately not our router to touch: dokploy-router-app no longer has either canonical fallback rule, indicating it has been configured with a real custom domain. The configuration is left untouched.

Test coverage

• Fresh-install router and canonical allowlist generation.
• Migration of a pre-fix default configuration while preserving unrelated config.
• Fallback host configured through server settings protects both HTTP and HTTPS routers.
• Custom-domain router remains untouched.
• Malformed/unparseable existing configuration does not crash startup or modify the file.
• An existing local-access middleware with incorrect content is reconciled to the canonical ipAllowList value.

Verification

• pnpm typecheck — passed.
• pnpm --filter=dokploy exec vitest run --config __test__/vitest.config.ts __test__/traefik/server/update-server-config.test.ts — passed (16/16).
• pnpm exec biome check packages/server/src/setup/traefik-setup.ts packages/server/src/utils/traefik/file-types.ts apps/dokploy/__test__/traefik/server/update-server-config.test.ts — passed; Biome reports one existing informational parseInt radix notice outside this change.

Greptile Summary

The PR adds a private-network allowlist to Dokploy’s default Traefik route and reconciles existing fallback configurations during startup.

• Generates the canonical dokploy-local-access middleware for new installations.
• Migrates valid existing fallback routers while preserving unrelated configuration.
• Skips malformed configurations and custom-domain routers.
• Adds regression coverage for generation, migration, malformed files, custom domains, and ineffective middleware definitions.

Confidence Score: 3/5

The PR is not yet safe to merge because assigning the fallback host after startup can restore public access to the Dokploy dashboard.

The startup migration correctly protects existing fallback routers, but the live settings path subsequently replaces their middleware configuration without preserving or reapplying the allowlist, leaving the previously reported fallback-host exposure reachable.

Files Needing Attention: packages/server/src/setup/traefik-setup.ts and packages/server/src/utils/traefik/web-server.ts

Security Review

The fallback-host restriction remains bypassable after startup: assigning dokploy.docker.localhost through server settings replaces the protected router middleware and creates an unrestricted secure router. The dashboard can therefore become publicly reachable until the next restart.

_{Reviews (8): Last reviewed commit: "fix(traefik): restrict default Dokploy r..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Context used:

• Knowledge Base — Traefik Networking
• Knowledge Base — Server Setup and Packaging

[9MidhunPM]

@Siumauricio Final update: the fallback-host regression is fixed, all Greptile threads are resolved, and typecheck, the 16-test targeted Traefik suite, and Biome pass. Ready for human review.

[greptile-apps]

Fallback restriction is later removed

When an administrator assigns dokploy.docker.localhost after startup, updateServerTraefik replaces the HTTP middleware list and recreates the secure router without dokploy-local-access. Because this reconciliation runs only during startup, the fallback dashboard becomes publicly reachable again until the next production restart.

Knowledge Base Used:

• Traefik Networking
• Server Setup and Packaging