Harden production security: Dockerfile build, nginx whitelist, and CSP.

Replace Dokploy runtime git clone with Dockerfile build to keep tokens out of the container, add nginx security headers and path whitelist, and scrub templates from the running image after HTML generation. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-27 16:58:27 +02:00
parent e22c26798b
commit f4775366ef
9 changed files with 116 additions and 57 deletions
@@ -4,7 +4,7 @@
 #
 # Po zmianie wartości uruchom: ./dev.sh config  (lub ./dev.sh restart)

-# --- Frontend Server ---
+# --- Frontend Server (TYLKO lokalny dev — nie używaj w Dokploy) ---
 # Port na hoście (localhost). W kontenerze nginx zawsze nasłuchuje na 80.
 FRONTEND_PORT=8082