Harden production workflows and agent admission

deploy/docker-compose.yml

@@ -1,10 +1,11 @@
 services:
   postgres:
-    image: postgres:16-alpine
+    image: postgres:16
     environment:
       POSTGRES_USER: monlet
       POSTGRES_PASSWORD: monlet
       POSTGRES_DB: monlet
+      POSTGRES_INITDB_ARGS: "--auth-local=scram-sha-256 --auth-host=scram-sha-256"
       TZ: UTC
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U monlet -d monlet"]
@@ -14,7 +15,7 @@ services:
     volumes:
       - monlet_pg:/var/lib/postgresql/data
     ports:
-      - "5432:5432"
+      - "${MONLET_POSTGRES_HOST_PORT:-5432}:5432"
 
   server:
     build:
@@ -36,12 +37,21 @@ services:
       - -c
       - "alembic upgrade head && uvicorn monlet_server.main:app --host 0.0.0.0 --port 8000"
     ports:
-      - "8000:8000"
+      - "${MONLET_SERVER_HOST_PORT:-8000}:8000"
     healthcheck:
       test: ["CMD-SHELL", "python -c 'import urllib.request,sys;sys.exit(0) if urllib.request.urlopen(\"http://localhost:8000/api/v1/ready\").status==200 else sys.exit(1)'"]
       interval: 5s
       timeout: 3s
       retries: 30
+    # PH-015: production hardening for runtime containers.
+    read_only: true
+    tmpfs:
+      - /tmp:size=64M
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    stop_grace_period: 15s
 
   web:
     build:
@@ -53,9 +63,29 @@ services:
       MONLET_API_BASE_URL: http://server:8000
       MONLET_API_TOKEN: ${MONLET_AUTH_TOKEN:?MONLET_AUTH_TOKEN is required}
       MONLET_WEB_TIME_ZONE: ${MONLET_WEB_TIME_ZONE:-UTC}
+      MONLET_WEB_AUTH_USERNAME: ${MONLET_WEB_AUTH_USERNAME:-}
+      MONLET_WEB_AUTH_PASSWORD: ${MONLET_WEB_AUTH_PASSWORD:-}
+      MONLET_WEB_TRUST_PROXY_AUTH: ${MONLET_WEB_TRUST_PROXY_AUTH:-false}
       TZ: ${MONLET_WEB_TIME_ZONE:-UTC}
     ports:
-      - "3000:3000"
+      - "${MONLET_WEB_HOST_PORT:-3000}:3000"
+    # PH-015: production hardening for the Next.js runtime. Next writes a small
+    # cache under .next/cache so we keep that path writable via tmpfs.
+    read_only: true
+    tmpfs:
+      - /tmp:size=64M
+      - /app/.next/cache:size=64M
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O- http://localhost:3000/api/health >/dev/null 2>&1 || exit 1"]
+      interval: 10s
+      timeout: 10s
+      retries: 10
+      start_period: 30s
+    stop_grace_period: 15s
 
   prometheus:
     image: prom/prometheus:v2.55.0