security: harden production configuration and routes

apps/pip-platform/docker-compose.runtime.yml

@@ -7,14 +7,14 @@ services:
     ports:
       - "8000:8000"
     environment:
-      DATABASE_URL: postgresql+asyncpg://pip:${PG_PASSWORD:-pip-secret}@postgres:5432/pip
+      DATABASE_URL: postgresql+asyncpg://pip:${PG_PASSWORD:?PG_PASSWORD must be set}@postgres:5432/pip
       REDIS_URL: redis://redis:6379/0
-      RABBITMQ_URL: amqp://pip:${RABBITMQ_PASSWORD:-pip-secret}@rabbitmq:5672/pip
-      JWT_SECRET_KEY: ${JWT_SECRET_KEY:-change-me-in-production}
+      RABBITMQ_URL: amqp://pip:${RABBITMQ_PASSWORD:?RABBITMQ_PASSWORD must be set}@rabbitmq:5672/pip
+      JWT_SECRET_KEY: ${JWT_SECRET_KEY:?JWT_SECRET_KEY must be set}
       NODE_ENV: production
       LOG_LEVEL: INFO
       LOG_JSON_FORMAT: "true"
-      CORS_ORIGINS: '["*"]'
+      CORS_ORIGINS: ${CORS_ORIGINS:?CORS_ORIGINS must be set}
       OTEL_EXPORTER_OTLP_ENDPOINT: http://host.docker.internal:4317
       OTEL_TRACES_ENABLED: "true"
     depends_on:
@@ -45,9 +45,7 @@ services:
     environment:
       POSTGRES_DB: pip
       POSTGRES_USER: pip
-      POSTGRES_PASSWORD: ${PG_PASSWORD:-pip-secret}
-    ports:
-      - "5432:5432"
+      POSTGRES_PASSWORD: ${PG_PASSWORD:?PG_PASSWORD must be set}
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
@@ -73,8 +71,6 @@ services:
   redis:
     image: redis:7-alpine
     restart: unless-stopped
-    ports:
-      - "6380:6379"
     volumes:
       - redis_data:/data
     healthcheck:
@@ -94,11 +90,8 @@ services:
     restart: unless-stopped
     environment:
       RABBITMQ_DEFAULT_USER: pip
-      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:-pip-secret}
+      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:?RABBITMQ_PASSWORD must be set}
       RABBITMQ_DEFAULT_VHOST: pip
-    ports:
-      - "5672:5672"
-      - "15672:15672"
     volumes:
       - rabbitmq_data:/var/lib/rabbitmq
     healthcheck:
@@ -111,4 +104,4 @@ services:
 volumes:
   postgres_data:
   redis_data:
-  rabbitmq_data:
+  rabbitmq_data: