MechaCat02 70a6598924 chore: harden docker-compose deployment (bind, memory limits, no-new-privileges) ...

- frontend publishes on ${FRONTEND_PUBLISH_ADDR:-127.0.0.1} not 0.0.0.0 (M4).
- mem_limit on backend(4g)/postgres(1g)/frontend(512m), .env-overridable (M3).
- security_opt: no-new-privileges on app + postgres services.
New knobs documented + allowlisted in the config meta-test; compose validates.
Deferred (need host verification): image pinning, backend healthcheck, cap_drop
on postgres/tor, Postgres backup sidecar.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-13 22:10:29 +02:00

..

migrations

fix: batch and index the crawler_jobs retention reaper

2026-07-13 21:46:01 +02:00

src

chore: harden docker-compose deployment (bind, memory limits, no-new-privileges)

2026-07-13 22:10:29 +02:00

tests

fix: fall back to the original when a thumbnail fails to decode

2026-07-13 21:41:28 +02:00

.dockerignore

bugfix: third-pass audit follow-ups (F1-F4 + dockerignore)

2026-05-17 00:13:14 +02:00

.gitignore

feat(analysis): add ocrs OCR backend and OCR-driven page text search

2026-06-30 19:52:43 +02:00

Cargo.lock

fix: tighten SSRF interceptor residuals

2026-07-13 22:00:55 +02:00

Cargo.toml

fix: tighten SSRF interceptor residuals

2026-07-13 22:00:55 +02:00

Dockerfile

feat(analysis): add ocrs OCR backend and OCR-driven page text search

2026-06-30 19:52:43 +02:00