From a8dbb02ff07828924978659781c9bd4ec3310737 Mon Sep 17 00:00:00 2001
From: curo1305 <curo1305@proton.me>
Date: Thu, 4 Jun 2026 23:08:19 +0200
Subject: [PATCH] fix(06): CR-01 CR-02 WR-02 WR-05 WR-06 WR-08 docker-compose
 security hardening

- CR-01: add CLOUD_CREDS_KEY to backend service environment
- CR-02: disable Grafana anonymous access, add admin credentials, bind Grafana and Loki to loopback (127.0.0.1)
- WR-02: replace --reload with --workers 2 for production backend
- WR-05: add read_only/tmpfs/cap_drop/no-new-privileges to celery-beat; redirect schedule file to /tmp
- WR-06: change LOG_JSON from hardcoded true to ${LOG_JSON:-true} for env-var override
- WR-08: add SECRET_KEY to celery-worker environment

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 docker-compose.yml | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index ad09851..9cbc1cf 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -68,12 +68,13 @@ services:
       - FRONTEND_URL=${FRONTEND_URL:-http://localhost:5173}
       - PYTHONDONTWRITEBYTECODE=1
       - LOG_LEVEL=${LOG_LEVEL:-INFO}
-      - LOG_JSON=${LOG_JSON:-false}
+      - LOG_JSON=${LOG_JSON:-true}
+      - CLOUD_CREDS_KEY=${CLOUD_CREDS_KEY}
     labels:
       logging: "promtail"
     extra_hosts:
       - "host.docker.internal:host-gateway"
-    command: uvicorn main:app --host 0.0.0.0 --port 8000 --reload
+    command: uvicorn main:app --host 0.0.0.0 --port 8000 --workers 2
     depends_on:
       postgres:
         condition: service_healthy
@@ -99,6 +100,7 @@ services:
       - MINIO_BUCKET=${MINIO_BUCKET}
       - REDIS_URL=${REDIS_URL}
       - CLOUD_CREDS_KEY=${CLOUD_CREDS_KEY}
+      - SECRET_KEY=${SECRET_KEY}
       - PYTHONDONTWRITEBYTECODE=1
     labels:
       logging: "promtail"
@@ -122,7 +124,6 @@ services:
     security_opt:
       - "no-new-privileges:true"
 
-  # celery-beat: NOT hardened — writes celerybeat-schedule to working directory (Phase 6 Pitfall 7).
   celery-beat:
     build: ./backend
     environment:
@@ -135,7 +136,7 @@ services:
       - PYTHONDONTWRITEBYTECODE=1
     extra_hosts:
       - "host.docker.internal:host-gateway"
-    command: celery -A celery_app beat --loglevel=info
+    command: celery -A celery_app beat --loglevel=info --schedule /tmp/celerybeat-schedule
     depends_on:
       postgres:
         condition: service_healthy
@@ -143,11 +144,18 @@ services:
         condition: service_healthy
       redis:
         condition: service_healthy
+    read_only: true
+    tmpfs:
+      - "/tmp:mode=1777"
+    cap_drop:
+      - ALL
+    security_opt:
+      - "no-new-privileges:true"
 
   loki:
     image: grafana/loki:latest
     ports:
-      - "3100:3100"
+      - "127.0.0.1:3100:3100"
     volumes:
       - ./docker/loki/loki-config.yaml:/etc/loki/local-config.yaml
       - loki_data:/loki
@@ -166,10 +174,11 @@ services:
   grafana:
     image: grafana/grafana:latest
     ports:
-      - "3000:3000"
+      - "127.0.0.1:3000:3000"
     environment:
-      - GF_AUTH_ANONYMOUS_ENABLED=true
-      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
+      - GF_AUTH_ANONYMOUS_ENABLED=false
+      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER:-admin}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-changeme}
     volumes:
       - grafana_data:/var/lib/grafana
     depends_on: