security: harden production configuration and routes

apps/pip-platform/docker-compose.yml

@@ -7,14 +7,14 @@ services:
     ports:
       - "8000:8000"
     environment:
-      DATABASE_URL: postgresql+asyncpg://pip:${PG_PASSWORD:-pip-secret}@postgres:5432/pip
+      DATABASE_URL: postgresql+asyncpg://pip:${PG_PASSWORD:?PG_PASSWORD must be set}@postgres:5432/pip
       REDIS_URL: redis://redis:6379/0
-      RABBITMQ_URL: amqp://pip:${RABBITMQ_PASSWORD:-pip-secret}@rabbitmq:5672/pip
-      JWT_SECRET_KEY: ${JWT_SECRET_KEY:-change-me-in-production}
+      RABBITMQ_URL: amqp://pip:${RABBITMQ_PASSWORD:?RABBITMQ_PASSWORD must be set}@rabbitmq:5672/pip
+      JWT_SECRET_KEY: ${JWT_SECRET_KEY:?JWT_SECRET_KEY must be set}
       NODE_ENV: production
       LOG_LEVEL: INFO
       LOG_JSON_FORMAT: "true"
-      CORS_ORIGINS: '["*"]'
+      CORS_ORIGINS: ${CORS_ORIGINS:?CORS_ORIGINS must be set}
       # Re-routed to the shared Grafana Alloy collector on srv84-macos.
       # host.docker.internal resolves to the Docker host gateway from
       # inside the container — works because this stack runs on the same
@@ -53,9 +53,7 @@ services:
     environment:
       POSTGRES_DB: pip
       POSTGRES_USER: pip
-      POSTGRES_PASSWORD: ${PG_PASSWORD:-pip-secret}
-    ports:
-      - "5432:5432"
+      POSTGRES_PASSWORD: ${PG_PASSWORD:?PG_PASSWORD must be set}
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
@@ -81,8 +79,6 @@ services:
   redis:
     image: redis:7-alpine
     restart: unless-stopped
-    ports:
-      - "6380:6379"
     volumes:
       - redis_data:/data
     healthcheck:
@@ -102,11 +98,8 @@ services:
     restart: unless-stopped
     environment:
       RABBITMQ_DEFAULT_USER: pip
-      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:-pip-secret}
+      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:?RABBITMQ_PASSWORD must be set}
       RABBITMQ_DEFAULT_VHOST: pip
-    ports:
-      - "5672:5672"
-      - "15672:15672"
     volumes:
       - rabbitmq_data:/var/lib/rabbitmq
     healthcheck: