fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
@@ -51,6 +51,9 @@ Verified by reading `deploy/deploy.sh` and `JobTrackerApi/Program.cs`:
        it fails loud rather than silently invalidating every session on restart)
      - `APP_PUBLIC_BASE_URL` — required canonical HTTPS origin with no path, query, fragment or
        credentials; it controls generated links, OAuth callbacks, secure cookies and Host validation
+      - `INGRESS_PROXY_CIDRS` — required observed Traefik socket peers at nginx; prefer individual
+        /32 or /128 addresses. Do not guess the source IP or trust a shared NAT gateway. See the
+        [B06 deployment checks](../docs/audits/2026-09-07/validation/b06-completion.md) before rollout.
      - `WEB_PROXY_SUBNET` — required dedicated IPv4 CIDR for nginx-to-backend traffic; confirm it
        does not overlap any existing Docker network before deployment
      - `AUTH_ADMIN_EMAIL` / `AUTH_ADMIN_PASSWORD` only if you want admin seeding on this boot