mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-02-18 00:17:39 +01:00
8dc5c4758e
Implements comprehensive security hardening for pulse-sensor-proxy: - Privilege drop from root to unprivileged user (UID 995) - Hash-chained tamper-evident audit logging with remote forwarding - Per-UID rate limiting (0.2 QPS, burst 2) with concurrency caps - Enhanced command validation with 10+ attack pattern tests - Fuzz testing (7M+ executions, 0 crashes) - SSH hardening, AppArmor/seccomp profiles, operational runbooks All 27 Phase 1 tasks complete. Ready for production deployment.
26 lines
604 B
YAML
26 lines
604 B
YAML
version: '3.8'
|
|
|
|
services:
|
|
pulse:
|
|
image: ${PULSE_IMAGE:-rcourtman/pulse:latest}
|
|
container_name: pulse
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${PULSE_PORT:-7655}:7655"
|
|
volumes:
|
|
- pulse-data:/data
|
|
# Secure temperature monitoring via host-side proxy
|
|
- /mnt/pulse-proxy:/mnt/pulse-proxy:ro
|
|
environment:
|
|
- TZ=${TZ:-UTC}
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:7655/api/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
volumes:
|
|
pulse-data:
|
|
driver: local
|