Editing Ov.430.ch Host Reconnaissance Report (section)

==== Stop publishing MediaWiki backend to public interfaces ====

Finding:

<pre>
mediawiki-mediawiki-1 mediawiki:latest 80/tcp=[{0.0.0.0 8080} {:: 8080}]
</pre>

Why it matters:

* Caddy is meant to be the public entry point.
* Direct backend exposure bypasses Caddy-layer controls and creates two public paths to the same app.
* IPv6 <code>8080</code> is confirmed open externally from this host's scan perspective.

Recommended fixes:

Option A, bind host port to loopback only:

<pre>
ports:
  - "127.0.0.1:8080:80"
</pre>

Option B, better: put Caddy on the Docker network and remove host port publication entirely.

Option C, add firewall rules in <code>DOCKER-USER</code> to reject public <code>8080</code>.