Harden authentication, tenant isolation and security boundaries

docker-compose.coolify.yml

@@ -1,6 +1,6 @@
 services:
   postgres:
-    image: postgres:16-alpine
+    image: postgres:16-alpine@sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea
     environment:
       POSTGRES_DB: ${POSTGRES_DB:-kita_planer}
       POSTGRES_USER: ${POSTGRES_USER:-kita_planer}
@@ -27,7 +27,7 @@ services:
       NODE_ENV: production
       PORT: 3000
       HOSTNAME: 0.0.0.0
-      DATABASE_URL: postgresql://${POSTGRES_USER:-kita_planer}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-kita_planer}?schema=public
+      DATABASE_URL: ${APP_DATABASE_URL:?}
       AUTH_SECRET: ${AUTH_SECRET:?}
       AUTH_URL: ${AUTH_URL:?}
       NEXTAUTH_URL: ${NEXTAUTH_URL:?}
@@ -39,17 +39,52 @@ services:
       EMAIL_FROM: ${EMAIL_FROM:?}
       ADMIN_EMAIL: ${ADMIN_EMAIL:?}
       UPLOAD_DIR: /app/uploads/announcements
+      UPLOAD_TENANT_QUOTA_BYTES: ${UPLOAD_TENANT_QUOTA_BYTES:-268435456}
+      UPLOAD_GLOBAL_QUOTA_BYTES: ${UPLOAD_GLOBAL_QUOTA_BYTES:-10737418240}
+      TRUSTED_CLIENT_IP_HEADER: ${TRUSTED_CLIENT_IP_HEADER:-}
+    volumes:
+      - kita_planer_uploads:/app/uploads
+      - kita_planer_next_cache:/app/.next/cache
+    depends_on:
+      postgres:
+        condition: service_healthy
+    expose:
+      - "3000"
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,mode=1777
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    pids_limit: 256
+    mem_limit: 1g
+    cpus: "1.0"
+    restart: unless-stopped
+
+  migrate:
+    profiles: ["maintenance"]
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: migrator
+      args:
+        NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:?}
+    environment:
+      NODE_ENV: production
+      DATABASE_URL: ${MIGRATION_DATABASE_URL:?}
+      APP_DATABASE_PASSWORD: ${APP_DATABASE_PASSWORD:?}
+      UPLOAD_DIR: /app/uploads/announcements
     volumes:
       - kita_planer_uploads:/app/uploads
     depends_on:
       postgres:
         condition: service_healthy
-    ports:
-      - "3000"
-    restart: unless-stopped
+    restart: "no"
 
   pgadmin:
-    image: dpage/pgadmin4:latest
+    profiles: ["maintenance"]
+    image: dpage/pgadmin4@sha256:c332c5f6dfba995d9ebc4af261d93506d6876085d712eaaa3defc8dd1a3f26de
     environment:
       PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL:?}
       PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD:?}
@@ -61,10 +96,11 @@ services:
       postgres:
         condition: service_healthy
     ports:
-      - "80"
+      - "127.0.0.1:5050:80"
     restart: unless-stopped
 
 volumes:
   kita_planer_postgres_data:
   kita_planer_uploads:
+  kita_planer_next_cache:
   kita_planer_pgadmin_data: