SEC-002 ingress and Compose verification

Date: 2026-08-02
Status: VERIFIED LOCALLY; operator Traefik and production checks remain.

Implemented boundary

Production automation explicitly selects docker-compose.yml; the auto-loaded override was replaced by explicitly selected docker-compose.dev.yml.
Base Compose publishes no frontend, backend, ai-service, or bundled-Ollama host port. Development adds 3000, 5202, and profile-scoped 11434.
Nginx and backend communicate over an internal dedicated CIDR; the backend accepts exactly one forwarded hop only from that CIDR.
Nginx derives its application server name from APP_PUBLIC_BASE_URL, rejects other Hosts except /health, and preserves Traefik's replaced proto/client headers rather than substituting internal HTTP.
Deploy preflight requires and validates the canonical origin and dedicated proxy CIDR. CI post-deploy commands use the production Compose file explicitly.

Command/check	Result
focused `ExternalOriginTests` including proxy config	Pass; 14/14
full backend Release suite	Pass; 476/476
frontend `npm run build`	Pass; Next production build and TypeScript
production and dev `docker compose ... config --quiet`	Pass
parsed Compose assertion including `bundled-ollama`	Pass; production ports absent; dev 3000/5202/11434; internal CIDR aligned
normalized `bash -n deploy/deploy.sh`	Pass
`bash -n job-tracker-ui/configure-nginx-origin.sh`	Pass
mounted nginx template `nginx -t` using already-installed local frontend image	Pass
ephemeral origin substitution with canonical host/port then `nginx -t`	Pass
ephemeral substitution with credential-bearing origin	Rejected as expected
`git diff --check`	Pass; line-ending conversion warnings only

No image was pulled and no production or persistent service was changed. Ephemeral Docker validation containers were removed automatically.

No Traefik configuration exists in this repository. Verify its exact Host() rule, TLS route, replacement of forwarding headers, selected Docker network, and hostile-Host rejection on the operator host.
WEB_PROXY_SUBNET must be chosen after production Docker-network inventory; the example value is not a production fact.
Host firewall and docker ps/published-port state are unverified.
The exact nginx:1.29.8-alpine base image was not installed locally. Syntax was checked with the existing local nginx frontend image; approved CI must build the pinned Dockerfile.
A complete local proxy/browser smoke was not run because rebuilding the pinned container would require an unavailable base image/package access. No browser claim is made.
Rollback is a normal application-version rollback plus the previous .env; do not reintroduce the deleted auto-loaded override or published production ports. If the new CIDR overlaps, roll back before replacement and select a non-overlapping CIDR.