fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
@@ -90,6 +90,10 @@ NEXT_PUBLIC_API_BASE_URL=
 APP_PUBLIC_BASE_URL=https://jobs.cesnimda.uk
 # Dedicated nginx-to-backend network. Confirm this CIDR does not overlap existing Docker networks.
 WEB_PROXY_SUBNET=172.31.250.0/29
+# Required for production: space-separated observed Traefik socket-peer CIDRs at nginx.
+# Prefer individual /32 or /128 addresses. Never guess Docker gateway/proxy addresses.
+# Empty fails deployment/nginx startup; development explicitly uses direct mode.
+INGRESS_PROXY_CIDRS=
 APP_VERSION=
 APP_COMMIT_SHA=
 APP_BUILD_STAMP=