From 392a48dfb92d4425b5313af4653bd54fb9823236 Mon Sep 17 00:00:00 2001
From: derekc <cooperd12003@msn.com>
Date: Fri, 20 Mar 2026 00:16:28 -0700
Subject: [PATCH] Go-live hardening: server_tokens, resource limits, pinned
 images, CVE fixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add server_tokens off to nginx (suppress version leakage)
- Add deploy.resources.limits to all containers (db: 512M, api: 256M, nginx: 64M)
- Pin image tags: mysql:8.0 → 8.0.45, nginx:alpine → 1.29.6-alpine
- Fix CVEs: cryptography 43.0.3 → 46.0.5 (HIGH), python-jose 3.3.0 → 3.4.0 (CRITICAL)
- Add .limit(500) to GET /api/flock and GET /api/admin/users

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 backend/requirements.txt |  4 ++--
 backend/routers/admin.py |  2 +-
 backend/routers/flock.py |  1 +
 docker-compose.yml       | 19 +++++++++++++++++--
 nginx/nginx.conf         |  2 ++
 5 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/backend/requirements.txt b/backend/requirements.txt
index fb9d40c..88982ab 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -2,8 +2,8 @@ fastapi==0.115.0
 uvicorn==0.32.0
 sqlalchemy==2.0.36
 pymysql==1.1.1
-cryptography==43.0.3
+cryptography==46.0.5
 pydantic==2.9.2
-python-jose[cryptography]==3.3.0
+python-jose[cryptography]==3.4.0
 passlib[bcrypt]==1.7.4
 bcrypt==4.0.1
diff --git a/backend/routers/admin.py b/backend/routers/admin.py
index d01b693..beb459d 100644
--- a/backend/routers/admin.py
+++ b/backend/routers/admin.py
@@ -18,7 +18,7 @@ def list_users(
     _: User = Depends(get_current_admin),
     db: Session = Depends(get_db),
 ):
-    return db.scalars(select(User).order_by(User.created_at)).all()
+    return db.scalars(select(User).order_by(User.created_at).limit(500)).all()
 
 
 @router.post("/users", response_model=UserOut, status_code=201)
diff --git a/backend/routers/flock.py b/backend/routers/flock.py
index c7ac3d5..033f9ae 100644
--- a/backend/routers/flock.py
+++ b/backend/routers/flock.py
@@ -22,6 +22,7 @@ def list_flock_history(
         select(FlockHistory)
         .where(FlockHistory.user_id == current_user.id)
         .order_by(FlockHistory.date.desc())
+        .limit(500)
     )
     return db.scalars(q).all()
 
diff --git a/docker-compose.yml b/docker-compose.yml
index a1b8893..fb452dd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,8 +4,13 @@ services:
   # MYSQL_ROOT_PASSWORD and MYSQL_PASSWORD should each be 20+ random characters.
   # Generate with: openssl rand -hex 16
   db:
-    image: mysql:8.0
+    image: mysql:8.0.45
     restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: '1.0'
+          memory: 512M
     env_file: .env
     logging:
       driver: json-file
@@ -33,6 +38,11 @@ services:
   api:
     build: ./backend
     restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: '1.0'
+          memory: 256M
     env_file: .env
     logging:
       driver: json-file
@@ -58,8 +68,13 @@ services:
 
   # ── Nginx ────────────────────────────────────────────────────────────────────
   nginx:
-    image: nginx:alpine
+    image: nginx:1.29.6-alpine
     restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 64M
     logging:
       driver: json-file
       options:
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index b9f8eb4..0f55c84 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -9,6 +9,8 @@ http {
     sendfile on;
 
     # ── Gzip compression ──────────────────────────────────────────────────────
+    server_tokens off;
+
     gzip            on;
     gzip_types      text/plain text/css application/javascript application/json;
     gzip_min_length 1000;