Security Audit Fixes: Session fixation prevention, SameSite cookies, audit log redaction, backup integrity, Docker hardening, error sanitization, rate limiting, trusted proxies, and config hardening

docker/Dockerfile

@@ -13,8 +13,15 @@ COPY frontend/ ./
 RUN npm run build
 
 FROM alpine:3.19
-RUN apk add --no-cache ca-certificates
+RUN apk add --no-cache ca-certificates && \
+    addgroup -S traefik-gui && \
+    adduser -S -G traefik-gui traefik-gui && \
+    mkdir -p /app/frontend/dist /data && \
+    chown -R traefik-gui:traefik-gui /app/frontend/dist /data
 COPY --from=backend /traefik-gui /usr/local/bin/traefik-gui
 COPY --from=frontend /app/frontend/dist /app/frontend/dist
+RUN chmod 755 /usr/local/bin/traefik-gui && \
+    chown -R traefik-gui:traefik-gui /app/frontend/dist
 EXPOSE 8080
+USER traefik-gui
 ENTRYPOINT ["traefik-gui"]

docker/docker-compose.yml

@@ -6,10 +6,10 @@ services:
       context: ..
       dockerfile: docker/Dockerfile
     ports:
-      - "8080:8080"
+      - "127.0.0.1:8080:8080"
     environment:
       - GUI_DB_PATH=/data/traefik-gui.db
-      - GUI_SESSION_SECRET=dev-secret-change-in-production-min-32-chars
+      - GUI_SESSION_SECRET=${GUI_SESSION_SECRET}
       - GUI_CORS_ORIGIN=http://localhost:5173
       - GUI_ADDR=:8080
       - GUI_DEV_MODE=true
@@ -17,6 +17,7 @@ services:
     volumes:
       - ./data:/data
       - ./configs:/etc/traefik-gui/configs
+    command: ["/bin/sh", "-c", "chmod 0600 /data/traefik-gui.db || true && traefik-gui --dev --addr :8080"]
     depends_on:
       - traefik
     networks:
@@ -25,16 +26,15 @@ services:
   traefik:
     image: traefik:v3.7
     ports:
-      - "80:80"
-      - "443:443"
-      - "8081:8080"
+      - "127.0.0.1:80:80"
+      - "127.0.0.1:443:443"
+      - "127.0.0.1:8081:8080"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./docker/traefik.dev.yml:/etc/traefik/traefik.yml:ro
       - ./configs/dynamic:/etc/traefik/dynamic:ro
     command:
-      - "--api.insecure=true"
-      - "--api.dashboard=true"
+      - "--api.dashboard=false"
       - "--log.level=DEBUG"
     networks:
       - traefik-gui-net

docker/traefik.dev.yml

@@ -1,6 +1,6 @@
 api:
-  dashboard: true
-  insecure: true
+  dashboard: false
+  insecure: false
 entryPoints:
   web:
     address: ":80"