Security Audit Fixes: Session fixation prevention, SameSite cookies, audit log redaction, backup integrity, Docker hardening, error sanitization, rate limiting, trusted proxies, and config hardening

docker/docker-compose.yml

@@ -6,10 +6,10 @@ services:
       context: ..
       dockerfile: docker/Dockerfile
     ports:
-      - "8080:8080"
+      - "127.0.0.1:8080:8080"
     environment:
       - GUI_DB_PATH=/data/traefik-gui.db
-      - GUI_SESSION_SECRET=dev-secret-change-in-production-min-32-chars
+      - GUI_SESSION_SECRET=${GUI_SESSION_SECRET}
       - GUI_CORS_ORIGIN=http://localhost:5173
       - GUI_ADDR=:8080
       - GUI_DEV_MODE=true
@@ -17,6 +17,7 @@ services:
     volumes:
       - ./data:/data
       - ./configs:/etc/traefik-gui/configs
+    command: ["/bin/sh", "-c", "chmod 0600 /data/traefik-gui.db || true && traefik-gui --dev --addr :8080"]
     depends_on:
       - traefik
     networks:
@@ -25,16 +26,15 @@ services:
   traefik:
     image: traefik:v3.7
     ports:
-      - "80:80"
-      - "443:443"
-      - "8081:8080"
+      - "127.0.0.1:80:80"
+      - "127.0.0.1:443:443"
+      - "127.0.0.1:8081:8080"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./docker/traefik.dev.yml:/etc/traefik/traefik.yml:ro
       - ./configs/dynamic:/etc/traefik/dynamic:ro
     command:
-      - "--api.insecure=true"
-      - "--api.dashboard=true"
+      - "--api.dashboard=false"
       - "--log.level=DEBUG"
     networks:
       - traefik-gui-net