security: remove hardcoded secrets, drop unneeded privileged mode, restrict internal-only ports to localhost

- watchtower: move Telegram token/chat ID to .env instead of plaintext in compose
- plex: remove stale/dead PLEX_CLAIM token
- uptime-kuma: mount docker.sock read-only (only needs to read container state)
- home-assistant: drop privileged: true (no device passthrough configured)
- glances: drop privileged: true, bind dashboard port to 127.0.0.1
- couchdb, docker-registry, leafweb: bind ports to 127.0.0.1 (proxy/localhost-only access confirmed, no direct LAN clients)

This commit is contained in:

poprhythm

2026-07-20 01:49:56 +00:00

parent 362643a064

commit 2f1a988ac3

8 changed files with 6 additions and 9 deletions

									
										leafweb/docker-compose.yml
									
		+1
		-1
	
												View File
												
				@@ -7,4 +7,4 @@ services:

				      SA_PASSWORD: ${SA_PASSWORD}

				      ACCEPT_EULA: Y

				    ports:

				      - "1433:1433"

				      - "127.0.0.1:1433:1433"