security: remove hardcoded secrets, drop unneeded privileged mode, restrict internal-only ports to localhost

- watchtower: move Telegram token/chat ID to .env instead of plaintext in compose
- plex: remove stale/dead PLEX_CLAIM token
- uptime-kuma: mount docker.sock read-only (only needs to read container state)
- home-assistant: drop privileged: true (no device passthrough configured)
- glances: drop privileged: true, bind dashboard port to 127.0.0.1
- couchdb, docker-registry, leafweb: bind ports to 127.0.0.1 (proxy/localhost-only access confirmed, no direct LAN clients)

couchdb/docker-compose.yml

@@ -4,7 +4,7 @@ services:
     container_name: couchdb
     restart: always
     ports:
-      - "5984:5984"
+      - "127.0.0.1:5984:5984"
     environment:
       - COUCHDB_USER=admin
       - COUCHDB_PASSWORD=${ADMIN_PASSWORD}

docker-registry/docker-compose.yaml

@@ -40,4 +40,4 @@ services:
       - /srv/registry/data:/data
       - /srv/registry/registry.password:/auth/registry.password
     ports:
-      - 5000
+      - 127.0.0.1:5000:5000

glances/docker-compose.yaml

@@ -3,9 +3,8 @@ services:
     container_name: glances
     image: 'nicolargo/glances:ubuntu-latest-full'
     restart: unless-stopped
-    privileged: true
     ports:
-      - 61208-61209:61208-61209
+      - 127.0.0.1:61208-61209:61208-61209
     environment:
       - TZ=${TZ}
       - NVIDIA_VISIBLE_DEVICES=all

home-assistant/docker-compose.yml

@@ -18,4 +18,3 @@ services:
       - VIRTUAL_PORT=8123
       - LETSENCRYPT_HOST=homeassistant.kolpacksoftware.com
     restart: unless-stopped
-    privileged: true

leafweb/docker-compose.yml

@@ -7,4 +7,4 @@ services:
       SA_PASSWORD: ${SA_PASSWORD}
       ACCEPT_EULA: Y
     ports:
-      - "1433:1433"
+      - "127.0.0.1:1433:1433"

plex/docker-compose.yaml

@@ -19,7 +19,6 @@ services:
       - 32414:32414/udp
     environment:
       - TZ=America/New_York
-      - PLEX_CLAIM=claim-VCuJznuC2nxFyVgAcKec
       - ADVERTISE_IP=http://73.108.236.191:32400/
       - NVIDIA_VISIBLE_DEVICES=all
       - NVIDIA_DRIVER_CAPABILITIES=compute,video,utility

uptime-kuma/docker-compose.yaml

@@ -5,7 +5,7 @@ services:
     restart: unless-stopped
     volumes:
       - /srv/uptime-kuma/data:/app/data
-      - /var/run/docker.sock:/var/run/docker.sock
+      - /var/run/docker.sock:/var/run/docker.sock:ro
     environment:
       - TZ=America/New_York
       - VIRTUAL_HOST=uptime.kolpacksoftware.com

watchtower/docker-compose.yml

@@ -8,7 +8,7 @@ services:
     environment:
       - WATCHTOWER_POLL_INTERVAL=300
       - WATCHTOWER_CLEANUP=true
-      - WATCHTOWER_NOTIFICATION_URL=telegram://8585007357:AAHtiEFm30Mpg6zl_1hww-BAWPXWu9GsDB0@telegram?chats=8444709468
+      - WATCHTOWER_NOTIFICATION_URL=telegram://${TELEGRAM_BOT_TOKEN}@telegram?chats=${TELEGRAM_CHAT_ID}
     labels:
       - com.centurylinklabs.watchtower.enable=false
     restart: unless-stopped