platform

yusiboyz/platform

Fork 0

Commit Graph

Author	SHA1	Message	Date
Yusuf Suleman	0ed8f1f83e	fix: deployment hardening — non-root containers and health checks (#10 ) - Gateway, Trips, Fitness Dockerfiles: run as non-root (appuser) - Added HEALTHCHECK to gateway, trips, fitness - Used --chown=appuser on COPY for correct file permissions - Created data dirs with proper ownership before USER switch - Trips Dockerfile no longer copies whole context (only server.py) Partial fix for #10 — Node services (inventory, budget, frontend) not yet hardened.	2026-03-29 09:18:42 -05:00
Yusuf Suleman	6bd23e7e8b	fix: security hardening across platform - Disable open /api/auth/register endpoint (gateway) - Require gateway session auth on Immich and Karakeep hooks proxies - Replace SHA-256 with bcrypt in fitness service (auth + seed) - Remove hardcoded Telegram user IDs from fitness seed - Add Secure flag to session cookie - Add domain allowlist and content-type validation to image proxy - Strengthen .gitignore (env variants, runtime data, test artifacts)	2026-03-29 08:25:50 -05:00
Yusuf Suleman	d3e250e361	Initial commit: Second Brain Platform Complete platform with unified design system and real API integration. Apps: Dashboard, Fitness, Budget, Inventory, Trips, Reader, Media, Settings Infrastructure: SvelteKit + Python gateway + Docker Compose	2026-03-28 23:20:40 -05:00

Author

SHA1

Message

Date

Yusuf Suleman

0ed8f1f83e

fix: deployment hardening — non-root containers and health checks (#10 )

- Gateway, Trips, Fitness Dockerfiles: run as non-root (appuser)
- Added HEALTHCHECK to gateway, trips, fitness
- Used --chown=appuser on COPY for correct file permissions
- Created data dirs with proper ownership before USER switch
- Trips Dockerfile no longer copies whole context (only server.py)

Partial fix for #10 — Node services (inventory, budget, frontend) not yet hardened.

2026-03-29 09:18:42 -05:00

Yusuf Suleman

6bd23e7e8b

fix: security hardening across platform

- Disable open /api/auth/register endpoint (gateway)
- Require gateway session auth on Immich and Karakeep hooks proxies
- Replace SHA-256 with bcrypt in fitness service (auth + seed)
- Remove hardcoded Telegram user IDs from fitness seed
- Add Secure flag to session cookie
- Add domain allowlist and content-type validation to image proxy
- Strengthen .gitignore (env variants, runtime data, test artifacts)

2026-03-29 08:25:50 -05:00

Yusuf Suleman

d3e250e361

Initial commit: Second Brain Platform

Complete platform with unified design system and real API integration.

Apps: Dashboard, Fitness, Budget, Inventory, Trips, Reader, Media, Settings
Infrastructure: SvelteKit + Python gateway + Docker Compose

2026-03-28 23:20:40 -05:00

3 Commits