2 Commits

Author	SHA1	Message	Date
NW	ba80784ae7	security(docker): remove privileged mode, SYS_MODULE; harden WireGuard (#49 #50) ... - Removed privileged: true from docker-compose.yml - Removed SYS_MODULE cap_add (kept NET_ADMIN for WireGuard) - Removed source code bind mounts (./src, package.json) - Removed wg0.conf and resolv.conf bind mounts (now generated from env) - Added resource limits: mem_limit 512m, cpus 1.0 - Added healthcheck with curl - Added non-root user appuser:appgroup in Dockerfile - wg0.conf now generated from env vars at container startup (WG_PRIVATE_KEY, etc.) - resolv.conf generated from WG_DNS env var - Rotated wg0.conf — private key removed from file - Added WG_ALLOWED_IPS to .env.example SECURITY: Rotate WireGuard keys on server if previously used in production	2026-06-22 01:26:35 +01:00
NW	7e0839d8cd	chore: add .env.example template and expand .gitignore for secrets ... - Add .env.example with all config vars (no real secrets) - Exclude .env, .env.*, docker-compose.override.yml - Exclude wg/ (WireGuard configs with private keys) - Exclude dump/, dump.zip, *.csv (sensitive exports) - Keep .env.example tracked (!.env.example exception)	2026-06-17 20:32:26 +01:00