Merge branch 'security/hardening-audit' into chore/consolidate-v2.0.0

docker/docker-compose-gpu.yml

@@ -33,12 +33,12 @@ services:
       - MAX_WORKER_THREADS=${MAX_WORKER_THREADS:-0}
       - PROCESSING_TIMEOUT_S=${PROCESSING_TIMEOUT_S:-0}
       - MAX_PIPELINE_STEPS=${MAX_PIPELINE_STEPS:-20}
-      - RATE_LIMIT_PER_MIN=${RATE_LIMIT_PER_MIN:-1000}
+      - RATE_LIMIT_PER_MIN=${RATE_LIMIT_PER_MIN:-300}
       - MAX_USERS=${MAX_USERS:-0}
       - SESSION_DURATION_HOURS=${SESSION_DURATION_HOURS:-168}
       - TRUST_PROXY=${TRUST_PROXY:-true}
       - DATABASE_URL=postgres://${POSTGRES_USER:-snapotter}:${POSTGRES_PASSWORD:-snapotter}@postgres:5432/${POSTGRES_DB:-snapotter}
-      - REDIS_URL=redis://redis:6379
+      - REDIS_URL=redis://:${REDIS_PASSWORD:-snapotter}@redis:6379
       # 1.x upgrade: uncomment to import the old SQLite database on first boot;
       # re-comment after the migration succeeds.
       # - SQLITE_MIGRATE_PATH=/data/snapotter.db
@@ -121,6 +121,7 @@ services:
     volumes:
       - SnapOtter-pgdata:/var/lib/postgresql/data
     restart: unless-stopped
+    mem_limit: 1g
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-snapotter}"]
       interval: 10s
@@ -131,12 +132,18 @@ services:
   redis:
     image: redis:8-alpine
     container_name: SnapOtter-redis
-    command: ["redis-server", "--maxmemory-policy", "noeviction", "--appendonly", "yes"]
+    command: >-
+      redis-server
+      --maxmemory-policy noeviction
+      --maxmemory 512mb
+      --appendonly yes
+      --requirepass ${REDIS_PASSWORD:-snapotter}
     volumes:
       - SnapOtter-redisdata:/data
     restart: unless-stopped
+    mem_limit: 1g
     healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-snapotter}", "--no-auth-warning", "ping"]
       interval: 10s
       timeout: 5s
       retries: 12

docker/docker-compose.yml

@@ -32,12 +32,12 @@ services:
       - MAX_WORKER_THREADS=${MAX_WORKER_THREADS:-0}
       - PROCESSING_TIMEOUT_S=${PROCESSING_TIMEOUT_S:-0}
       - MAX_PIPELINE_STEPS=${MAX_PIPELINE_STEPS:-20}
-      - RATE_LIMIT_PER_MIN=${RATE_LIMIT_PER_MIN:-1000}
+      - RATE_LIMIT_PER_MIN=${RATE_LIMIT_PER_MIN:-300}
       - MAX_USERS=${MAX_USERS:-0}
       - SESSION_DURATION_HOURS=${SESSION_DURATION_HOURS:-168}
       - TRUST_PROXY=${TRUST_PROXY:-true}
       - DATABASE_URL=postgres://${POSTGRES_USER:-snapotter}:${POSTGRES_PASSWORD:-snapotter}@postgres:5432/${POSTGRES_DB:-snapotter}
-      - REDIS_URL=redis://redis:6379
+      - REDIS_URL=redis://:${REDIS_PASSWORD:-snapotter}@redis:6379
       # 1.x upgrade: uncomment to import the old SQLite database on first boot;
       # re-comment after the migration succeeds.
       # - SQLITE_MIGRATE_PATH=/data/snapotter.db
@@ -113,6 +113,7 @@ services:
     volumes:
       - SnapOtter-pgdata:/var/lib/postgresql/data
     restart: unless-stopped
+    mem_limit: 1g
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-snapotter}"]
       interval: 10s
@@ -123,12 +124,18 @@ services:
   redis:
     image: redis:8-alpine
     container_name: SnapOtter-redis
-    command: ["redis-server", "--maxmemory-policy", "noeviction", "--appendonly", "yes"]
+    command: >-
+      redis-server
+      --maxmemory-policy noeviction
+      --maxmemory 512mb
+      --appendonly yes
+      --requirepass ${REDIS_PASSWORD:-snapotter}
     volumes:
       - SnapOtter-redisdata:/data
     restart: unless-stopped
+    mem_limit: 1g
     healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-snapotter}", "--no-auth-warning", "ping"]
       interval: 10s
       timeout: 5s
       retries: 12

docker/entrypoint.sh

@@ -104,6 +104,18 @@ if [ -n "${DATABASE_URL:-}" ]; then
   echo "Postgres is reachable."
 fi
 
+print_security_warnings() {
+  if [ "${DEFAULT_PASSWORD}" = "admin" ]; then
+    printf '  \033[33mWARNING:%b Default admin password is still "admin". Change it for any non-local deployment.\n' '\033[0m' >&2
+  fi
+  if echo "${DATABASE_URL:-}" | grep -q "snapotter:snapotter@"; then
+    printf '  \033[33mWARNING:%b Default Postgres credentials in use. Set POSTGRES_PASSWORD for production.\n' '\033[0m' >&2
+  fi
+  if echo "${REDIS_URL:-}" | grep -q ":snapotter@"; then
+    printf '  \033[33mWARNING:%b Default Redis password in use. Set REDIS_PASSWORD for production.\n' '\033[0m' >&2
+  fi
+}
+
 print_banner() {
   RST='\033[0m'
   printf '\n'
@@ -114,6 +126,7 @@ print_banner() {
   printf '  \033[33m➜%b  Login  \033[1m%s%b / \033[1m[CHANGE ON FIRST LOGIN]%b\n' "$RST" "${DEFAULT_USERNAME}" "$RST" "$RST"
   printf '  \033[36m➜%b  Docs   \033[2mhttps://docs.snapotter.com%b\n' "$RST" "$RST"
   printf '\n'
+  print_security_warnings
 }
 
 # Fix ownership of mounted volumes so the non-root snapotter user can write.