fix(deploy): close container final review

2026-07-12 00:44:39 +02:00
parent 0ca6346f75
commit a3a266fd81
30 changed files with 526 additions and 37 deletions
@@ -236,6 +236,13 @@ git commit -m "build(docker): add runtime-configured frontend image"

 ### Task 5: Compose external profile and end-to-end smoke gate

+> **Final-review security amendment (2026-07-12):** the frontend port binds to `127.0.0.1` by
+> default. Public deployment uses an authenticated upstream proxy with `AUTH_MODE=upstream`;
+> `THOTH_PUBLIC_EXPOSURE=true` plus `AUTH_MODE=none` is invalid. Local env files are development
+> only; production uses read-only Compose secrets. Image gates pin exact tags and multi-platform
+> digests and verify both linux/amd64 and linux/arm64 using the shared container verification
+> script.
+
 **Files:**
 - Create: `compose.yaml`
 - Create: `deploy/env.example`