security: harden data auth and deployment

2026-09-17 18:31:35 +12:00
parent a6d1c73837
commit 5639dbcb83
32 changed files with 1401 additions and 378 deletions
@@ -5,6 +5,13 @@ services:
      - ./.env
    ports:
      - "3000:3000"
-      - "8000:8000"
+      - "127.0.0.1:8000:8000"
    volumes:
      - ./data:/app/data
+    read_only: true
+    cap_drop: ["ALL"]
+    security_opt: ["no-new-privileges:true"]
+    init: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=64m,uid=1000,gid=1000
+      - /app/frontend/.next/cache:rw,noexec,nosuid,size=128m,uid=1000,gid=1000