fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
@@ -590,6 +590,15 @@ if ! validate_deploy_config; then
  exit 1
 fi

+# Render exactly the production file used below. Fail before backup/build/replacement;
+# never print the rendered environment, which contains deployment secrets.
+if [ "${DEPLOY_BACKUP_ONLY:-false}" != "true" ]; then
+  if ! compose --profile bundled-ollama config --format json | python3 scripts/validate-ingress.py; then
+    echo "Production ingress validation failed. No service was replaced."
+    exit 1
+  fi
+fi
+
 if ! backup_database; then
  exit 1
 fi