Real visitor addresses with Docker Desktop

Tesria notes the network address of every visit: for sign-in limits, security alerts, the audit log, and blocking an address that attacks it. On a Linux server that just works. With Docker Desktop on a Mac or on Windows it does not: Docker Desktop receives every connection itself and passes it on from one address of its own, 192.168.65.1. Your laptop, your phone and a stranger then all look like the same visitor.

Tesria notices this. An alert about that address says every device shares it, and it cannot be blocked, since blocking it would lock everyone out. This page fixes it properly: a small program on the computer itself, where the real address can still be seen, hands each visit to Tesria with its real address attached.

Before you start

• Node.js on the computer Tesria runs on, from nodejs.org. Nothing else is installed.

• Tesria running as Installing with Docker Compose describes, with its .env in the Tesria folder.

On a Mac

Step 1: Run the setup

In Terminal, in the Tesria folder:

deploy/docker-desktop/install-macos.sh

It adds one line to .env, moves Tesria’s web server to ports only this Mac can reach, and adds a login item that takes over ports 80 and 443. It ends by saying Tesria answers.

Step 2: Allow incoming connections

If macOS asks whether node may accept incoming network connections, choose Allow. Without it, other devices cannot reach Tesria.

On Windows

Step 1: Open PowerShell as administrator

Open the Start menu, type PowerShell, and choose Run as administrator. Administrator rights are needed to add the firewall rule and the task that starts it when you sign in.

Step 2: Run the setup

Go to the Tesria folder, then run:

powershell -ExecutionPolicy Bypass -File deploy\docker-desktop\install-windows.ps1

It does the same as on a Mac, with a Windows Firewall rule, and a Task Scheduler task that runs in the background from startup, with no window.

Check it

Sign in to Tesria from another device, such as your phone on the same Wi-Fi. Then open Admin, Audit (Admin is in the top bar; in a narrower window it is under More, and on a phone in the ☰ menu): the sign-in shows that device’s own address, such as 192.168.1.50, instead of 192.168.65.1.

Worth knowing

• It runs while you are signed in to the Mac. The Mac’s login item starts when you sign in. On Windows the task starts with the computer, but Docker Desktop itself waits for someone to sign in, so Tesria answers once they have either way.

• Nothing else changes. Devices keep the same address for Tesria, and the certificate stays the same, so nothing needs trusting again.

• It cannot be used to fake an address. Tesria’s web server now accepts connections only from this computer, and believes the attached address only from there.

Undo it

On a Mac:

deploy/docker-desktop/install-macos.sh --uninstall

On Windows, in PowerShell as administrator:

powershell -ExecutionPolicy Bypass -File deploy\docker-desktop\install-windows.ps1 -Uninstall

Either puts everything back as it was.