Add security hardening and PostgreSQL 18 upgrade support

Add ALLOWED_HOSTS configuration to restrict trusted hosts in TrustedHostMiddleware. Enhance SSRF protection to block all private, loopback, link-local, multicast, reserved, and unspecified IP addresses using ipaddress module and DNS resolution checks. Add encrypt_value/decrypt_value aliases for encryption functions. Upgrade PostgreSQL from 16 to 18.4 in Docker Compose with updated data directory path (/var/lib/postgresql). Add security_opt no
2026-06-21 09:44:47 +02:00
parent d694c8b8e3
commit dfec7976c4
8 changed files with 78 additions and 20 deletions
@@ -43,6 +43,7 @@ MAX_LOGIN_ATTEMPTS=5
 LOGIN_LOCKOUT_MINUTES=15
 RATE_LIMIT_DEFAULT=100
 RATE_LIMIT_LOGIN=10
+ALLOWED_HOSTS=localhost,127.0.0.1,testserver,nexadash-api

 # -----------------------------------------------------------
 # Mail (SMTP)