fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
@@ -0,0 +1,96 @@
+{
+  "command": [
+    "docker",
+    "compose",
+    "--env-file",
+    ".artifacts/b06/compose.env",
+    "-f",
+    "docker-compose.yml",
+    "--profile",
+    "bundled-ollama",
+    "config",
+    "--format",
+    "json"
+  ],
+  "input": "Synthetic test env, not deployed .env; peer 192.0.2.10/32 is NOT an observed Traefik peer",
+  "services": {
+    "ai-service": {
+      "ports": [],
+      "expose": [
+        "8001"
+      ],
+      "networks": {
+        "ai_internal": null
+      }
+    },
+    "backend": {
+      "ports": [],
+      "expose": [
+        "8080"
+      ],
+      "networks": {
+        "ai_internal": null,
+        "default": null,
+        "shared_services": null,
+        "web_proxy": {
+          "aliases": [
+            "backend-web"
+          ]
+        }
+      }
+    },
+    "frontend": {
+      "ports": [
+        {
+          "mode": "ingress",
+          "target": 80,
+          "published": "3000",
+          "protocol": "tcp"
+        }
+      ],
+      "expose": [
+        "80"
+      ],
+      "networks": {
+        "shared_services": null,
+        "web_proxy": null
+      }
+    },
+    "ollama": {
+      "ports": [],
+      "expose": [
+        "11434"
+      ],
+      "networks": {
+        "ai_internal": null
+      }
+    }
+  },
+  "networks": {
+    "ai_internal": {
+      "name": "jobtracker_ai_internal",
+      "driver": "bridge",
+      "ipam": {}
+    },
+    "default": {
+      "name": "jobtracker_default",
+      "ipam": {}
+    },
+    "shared_services": {
+      "name": "jobtracker_shared",
+      "ipam": {},
+      "external": true
+    },
+    "web_proxy": {
+      "name": "jobtracker_web_proxy",
+      "ipam": {
+        "config": [
+          {
+            "subnet": "172.31.250.0/29"
+          }
+        ]
+      },
+      "internal": true
+    }
+  }
+}