Security fixes from the October 2026 audit

.env.example

@@ -11,11 +11,21 @@
 #   make up
 #
 # If .env is absent, docker-compose uses the defaults shown here (via ${VAR:-default}).
-# The defaults are safe for a local-only stack; change them if you expose
-# the stack on a shared network.
+# The defaults are PUBLISHED dev values. They are acceptable only because every
+# port binds to 127.0.0.1 (see FP_BIND_ADDR below). Replace every *_PASSWORD
+# before binding to anything else.
 #
 # ============================================================================
 
+# ----------------------------------------------------------------------------
+# NETWORK EXPOSURE
+# ----------------------------------------------------------------------------
+# Address every published port binds to. With a REMOTE docker engine (docker
+# context over ssh) this address is on the engine host, not your laptop, and
+# 0.0.0.0 there means its LAN and VPN interfaces. Prefer an ssh tunnel
+# (ssh -L 6379:127.0.0.1:6379 <engine-host>) over changing this.
+FP_BIND_ADDR=127.0.0.1
+
 # ----------------------------------------------------------------------------
 # POSTGRES
 # ----------------------------------------------------------------------------
@@ -29,6 +39,16 @@ POSTGRES_PASSWORD=fp
 MINIO_ROOT_USER=minioadmin
 MINIO_ROOT_PASSWORD=minioadmin
 
+# ----------------------------------------------------------------------------
+# REDIS / NATS (both require auth)
+# ----------------------------------------------------------------------------
+# The Go services' local defaults use these same dev values:
+#   FP_REDIS_URL=redis://:${REDIS_PASSWORD}@localhost:6379
+#   FP_NATS_URL=nats://fp:${NATS_PASSWORD}@localhost:4222
+# If you change a password here, export the matching FP_* URL before `go run`.
+REDIS_PASSWORD=fp
+NATS_PASSWORD=fp
+
 # ----------------------------------------------------------------------------
 # GRAFANA
 # ----------------------------------------------------------------------------

.github/dependabot.yml

@@ -19,6 +19,10 @@
 #     that would have caught the failure that kept Security red for a month:
 #     the pinned trivy-action v0.29.0 referenced aquasecurity/setup-trivy@v0.2.2,
 #     a tag upstream deleted, so the job died in "Set up job" in four seconds.
+#   - docker / helm / docker-compose: the digest-pinned base images, the infra
+#     images in deploy/, the migrate image in the charts, and the compose
+#     stack. (Added 2026-10: before that nothing refreshed a single digest pin.)
+#   - terraform: provider constraints + .terraform.lock.hcl per root module.
 #
 # WHY GROUPED UPDATES:
 #   15 modules x N dependencies of individual PRs is noise nobody reads, and
@@ -102,3 +106,115 @@ updates:
         update-types:
           - minor
           - patch
+
+  # ---------------------------------------------------------------------------
+  # Docker images — base images in the Dockerfiles and the images the raw
+  # Kubernetes manifests run.
+  # ---------------------------------------------------------------------------
+  # WHY: every Dockerfile pins golang:<ver>-alpine and distroless by DIGEST, and
+  # the infra manifests pin postgres/redis/nats/ollama/... by tag AND digest. A
+  # digest pin is only safe while something refreshes it: without this entry
+  # the pins silently go stale and the images keep their CVEs forever.
+  # Dependabot's docker ecosystem reads Dockerfiles and, per GitHub's docs,
+  # Kubernetes manifests; it rewrites tag and digest together.
+  - package-ecosystem: docker
+    directories:
+      - /services/*
+      - /deploy/k8s/infra/*
+      - /deploy/k8s/observability/*
+      - /deploy/llm
+      - /deploy/backup
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: deps(docker)
+    groups:
+      docker-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # A database major is a data migration (pg_upgrade / dump-restore for
+      # Postgres, a licence and persistence-format change for Redis 8), not a
+      # dependency bump. Plan those by hand.
+      - dependency-name: postgres
+        update-types: ["version-update:semver-major"]
+      - dependency-name: redis
+        update-types: ["version-update:semver-major"]
+
+  # ---------------------------------------------------------------------------
+  # Helm charts — images referenced in deploy/helm/*/values.yaml (the
+  # migrate/migrate initContainer, pinned by digest).
+  # ---------------------------------------------------------------------------
+  - package-ecosystem: helm
+    directories:
+      - /deploy/helm/*
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: deps(helm)
+    groups:
+      helm-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+
+  # ---------------------------------------------------------------------------
+  # docker-compose — the local dev stack (docker-compose.yaml).
+  # ---------------------------------------------------------------------------
+  - package-ecosystem: docker-compose
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: deps(compose)
+    groups:
+      compose-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+    ignore:
+      - dependency-name: postgres
+        update-types: ["version-update:semver-major"]
+      - dependency-name: redis
+        update-types: ["version-update:semver-major"]
+
+  # ---------------------------------------------------------------------------
+  # pre-commit — the pinned gitleaks hook in .pre-commit-config.yaml.
+  # ---------------------------------------------------------------------------
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 2
+    commit-message:
+      prefix: deps(pre-commit)
+
+  # ---------------------------------------------------------------------------
+  # Terraform — provider constraints AND the committed .terraform.lock.hcl,
+  # one entry per root module.
+  # ---------------------------------------------------------------------------
+  # Majors stay separate (an AWS provider major, e.g. 5 -> 6, renames and
+  # removes arguments and needs a reviewed migration).
+  - package-ecosystem: terraform
+    directories:
+      - /deploy/terraform/bootstrap
+      - /deploy/terraform/environments/dev
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: deps(terraform)
+    groups:
+      terraform-minor-and-patch:
+        update-types:
+          - minor
+          - patch

.github/workflows/ci.yml

@@ -50,11 +50,15 @@ concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
-# Pin the toolchain to the go.work `go 1.26.0` directive. The Go toolchain
-# refuses to build a workspace whose go directive is newer than the toolchain,
-# so this MUST track go.work (bump both together on a Go upgrade).
+# Pin the toolchain to the exact patch release in go.work's `go 1.26.10`
+# directive. setup-go sets GOTOOLCHAIN=local, so a toolchain older than that
+# directive refuses to build the workspace; this MUST track go.work, every
+# go.mod and the golang builder image in services/*/Dockerfile (bump all of
+# them together on a Go upgrade). A bare "1.26" let setup-go pick whatever
+# 1.26.x the runner had cached (1.26.9, which govulncheck flags for
+# GO-2026-6809 in crypto/x509).
 env:
-  GO_VERSION: "1.26"
+  GO_VERSION: "1.26.10"
 
 jobs:
   # ---------------------------------------------------------------------------