security: compose必填变量+环回绑定+nginx安全头/admin内网化；产物去跟踪88项；冻结规格+审计+BLOCKED runbook落盘

docker-compose.yml

@@ -11,22 +11,22 @@
 # ============================================================
 
 x-backend-env: &backend-env
-  DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:-docker-dev-only-secret-change-in-production}
-  # 默认 True（局域网/开发无 TLS）；生产环境启用 TLS 时显式设 DJANGO_DEBUG=False
-  DJANGO_DEBUG: ${DJANGO_DEBUG:-True}
+  DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:?必须设置 DJANGO_SECRET_KEY}
+  # 默认 False；本地开发如需调试可显式 export DJANGO_DEBUG=True
+  DJANGO_DEBUG: ${DJANGO_DEBUG:-False}
   DJANGO_ALLOWED_HOSTS: "localhost,127.0.0.1,backend,nginx,host.docker.internal,192.168.5.7"
   CORS_ALLOWED_ORIGINS: "http://localhost:8080,http://127.0.0.1:8080,http://localhost:5173,http://127.0.0.1:5173,http://192.168.5.7:18080"
   # --- PostgreSQL（异步 ORM 必备）---
   DB_ENGINE: "django.db.backends.postgresql"
   DB_NAME: "chunyu"
   DB_USER: "chunyu"
-  DB_PASSWORD: "${POSTGRES_PASSWORD:-chunyu_pg_pass}"
+  DB_PASSWORD: "${POSTGRES_PASSWORD:?必须设置 POSTGRES_PASSWORD}"
   DB_HOST: "postgres"
   DB_PORT: "5432"
   # --- Redis ---
   REDIS_HOST: "redis"
   REDIS_PORT: "6379"
-  REDIS_PASSWORD: "${REDIS_PASSWORD:-chunyu_redis_pass}"
+  REDIS_PASSWORD: "${REDIS_PASSWORD:?必须设置 REDIS_PASSWORD}"
 
 services:
   # ============================================
@@ -38,10 +38,10 @@ services:
     environment:
       POSTGRES_DB: chunyu
       POSTGRES_USER: chunyu
-      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-chunyu_pg_pass}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?必须设置 POSTGRES_PASSWORD}"
       TZ: Asia/Shanghai
     ports:
-      - "5432:5432"
+      - "127.0.0.1:5432:5432"
     volumes:
       - postgres_data:/var/lib/postgresql/data
     networks:
@@ -61,12 +61,12 @@ services:
     container_name: chunyu-redis
     command: >
       redis-server
-      --requirepass ${REDIS_PASSWORD:-chunyu_redis_pass}
+      --requirepass ${REDIS_PASSWORD:?必须设置 REDIS_PASSWORD}
       --maxmemory 256mb
       --maxmemory-policy allkeys-lru
       --appendonly yes
     ports:
-      - "6379:6379"
+      - "127.0.0.1:6379:6379"
     volumes:
       - redis_data:/data
     networks:
@@ -78,7 +78,7 @@ services:
       timeout: 5s
       retries: 10
     environment:
-      REDIS_PASSWORD: ${REDIS_PASSWORD:-chunyu_redis_pass}
+      REDIS_PASSWORD: ${REDIS_PASSWORD:?必须设置 REDIS_PASSWORD}
 
   # ============================================
   # Django Backend —— Granian(Rust) + ADRF 异步视图 + 异步 ORM