From 3335f37a72d84ce4d0ae9168fe568b9a488d2efd Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 12:58:59 +0200
Subject: [PATCH 01/20] security(traefikdashboard): add caps

---
 docker/traefik-log-dashboard/compose.yaml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/docker/traefik-log-dashboard/compose.yaml b/docker/traefik-log-dashboard/compose.yaml
index ad52fdf..d67b735 100644
--- a/docker/traefik-log-dashboard/compose.yaml
+++ b/docker/traefik-log-dashboard/compose.yaml
@@ -5,6 +5,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     healthcheck:
       test: [ "CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:5000/api/logs/status" ]
       interval: 2m
@@ -30,6 +38,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     depends_on:
       agent:
         condition: "service_healthy"

From 1428ab06f4e3e237a167bd9a38610bb1ecf15866 Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 12:59:38 +0200
Subject: [PATCH 02/20] security(archiv): caps

---
 docker/archiv/compose.yaml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/docker/archiv/compose.yaml b/docker/archiv/compose.yaml
index 7da1651..282e5a1 100644
--- a/docker/archiv/compose.yaml
+++ b/docker/archiv/compose.yaml
@@ -5,6 +5,12 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
     environment:
       TZ: "Europe/Berlin"
     networks:
@@ -28,6 +34,13 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "DAC_OVERRIDE"
     environment:
       MARIADB_AUTO_UPGRADE: "1"
       MARIADB_DISABLE_UPGRADE_BACKUP: "1"
@@ -53,6 +66,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     volumes:
       - "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/db-backups:/backup:z"
     environment:

From 954378f3adb7b7aa1ba766a14d6d3f23d60101b0 Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:01:05 +0200
Subject: [PATCH 03/20] security(a3s): caps

---
 docker/arma3sync-repo/compose.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docker/arma3sync-repo/compose.yaml b/docker/arma3sync-repo/compose.yaml
index 3130e0d..c89e290 100644
--- a/docker/arma3sync-repo/compose.yaml
+++ b/docker/arma3sync-repo/compose.yaml
@@ -6,6 +6,10 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "NET_BIND_SERVICE"
     volumes:
       - "arma3sync-repo:/srv:ro"
       - "./browse.html:/templates/browse.html:ro,Z"

From 5f66bb6d725c29b5bc9caec48a664e4a28ac6c0f Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:01:17 +0200
Subject: [PATCH 04/20] security(asm): caps

---
 docker/armaservermanager/compose.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/docker/armaservermanager/compose.yaml b/docker/armaservermanager/compose.yaml
index e37d81f..ca3e2a0 100644
--- a/docker/armaservermanager/compose.yaml
+++ b/docker/armaservermanager/compose.yaml
@@ -5,6 +5,13 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "DAC_OVERRIDE"
     ports:
       - "3306:3306"
     environment:
@@ -30,6 +37,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     volumes:
       - "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/db-backups:/backup:z"
     environment:

From eb4bcaa50a0facccb31d0fdefa9de83cf4b66219 Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:01:31 +0200
Subject: [PATCH 05/20] security(authentik): caps

---
 docker/authentik/compose.yaml | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/docker/authentik/compose.yaml b/docker/authentik/compose.yaml
index f1ac159..e72de74 100644
--- a/docker/authentik/compose.yaml
+++ b/docker/authentik/compose.yaml
@@ -6,6 +6,13 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "FOWNER"
+      - "SETUID"
+      - "SETGID"
     depends_on:
       db:
         condition: "service_healthy"
@@ -51,12 +58,19 @@ services:
     container_name: "${COMPOSE_PROJECT_NAME:?error}-worker"
     command: "worker"
     restart: "unless-stopped"
+    user: "root"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "FOWNER"
+      - "SETUID"
+      - "SETGID"
     depends_on:
       db:
         condition: "service_healthy"
-    user: "root"
     volumes:
       - "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/data:/data:z"
       - "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/templates:/templates:z"
@@ -83,6 +97,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     healthcheck:
       interval: "30s"
       retries: 5
@@ -105,6 +127,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     volumes:
       - "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/db-backups:/backup:z"
     environment:

From db25af947f6ae9574141792b4da317f7cda69606 Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:02:01 +0200
Subject: [PATCH 06/20] security(beszel): caps

---
 docker/beszel/compose.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docker/beszel/compose.yaml b/docker/beszel/compose.yaml
index ebf140b..f87374c 100644
--- a/docker/beszel/compose.yaml
+++ b/docker/beszel/compose.yaml
@@ -5,6 +5,8 @@ services:
     restart: unless-stopped
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
     environment:
       TZ: "${TZ:-Europe/Berlin}"
       USER_CREATION: "true"

From 8d5ccb81d277d57d38a8becbe98897ef7cc59411 Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:02:48 +0200
Subject: [PATCH 07/20] security(dbeaver): caps

---
 docker/cloudbeaver/compose.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docker/cloudbeaver/compose.yaml b/docker/cloudbeaver/compose.yaml
index 622b1e5..a452357 100644
--- a/docker/cloudbeaver/compose.yaml
+++ b/docker/cloudbeaver/compose.yaml
@@ -5,6 +5,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     environment:
       TZ: "Europe/Berlin"
     networks:

From 6dd887fb6f8379fe67f04bd0f46da67349f03742 Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:03:20 +0200
Subject: [PATCH 08/20] security(coredns): caps, fix ?error

---
 docker/coredns/compose.yaml | 42 ++++++++++++++++++++-----------------
 1 file changed, 23 insertions(+), 19 deletions(-)

diff --git a/docker/coredns/compose.yaml b/docker/coredns/compose.yaml
index 01c7d82..2a0725a 100644
--- a/docker/coredns/compose.yaml
+++ b/docker/coredns/compose.yaml
@@ -6,6 +6,10 @@ services:
     command: "-conf /etc/coredns/Corefile -dns.port 53"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "NET_BIND_SERVICE"
     ports:
       - "${IPV4:?error}:53:53"
       - "${IPV4:?error}:53:53/udp"
@@ -18,37 +22,37 @@ services:
 configs:
   corefile:
     content: |
-      ${DOMAINNAME?error} {
+      ${DOMAINNAME:?error} {
         log
         errors
       
         hosts {
-          ${IPV4:?error} backup.${DOMAINNAME?error}
-          ${IPV6:?error} backup.${DOMAINNAME?error}
+          ${IPV4:?error} backup.${DOMAINNAME:?error}
+          ${IPV6:?error} backup.${DOMAINNAME:?error}
       
-          ${IPV4:?error} komodo.${DOMAINNAME?error}
-          ${IPV6:?error} komodo.${DOMAINNAME?error}
+          ${IPV4:?error} komodo.${DOMAINNAME:?error}
+          ${IPV6:?error} komodo.${DOMAINNAME:?error}
       
-          ${IPV4:?error} docker0.${DOMAINNAME?error}
-          ${IPV6:?error} docker0.${DOMAINNAME?error}
+          ${IPV4:?error} docker0.${DOMAINNAME:?error}
+          ${IPV6:?error} docker0.${DOMAINNAME:?error}
       
-          ${IPV4:?error} traefik.${DOMAINNAME?error}
-          ${IPV6:?error} traefik.${DOMAINNAME?error}
+          ${IPV4:?error} traefik.${DOMAINNAME:?error}
+          ${IPV6:?error} traefik.${DOMAINNAME:?error}
       
-          ${IPV4:?error} traefik-log-dashboard.${DOMAINNAME?error}
-          ${IPV6:?error} traefik-log-dashboard.${DOMAINNAME?error}
+          ${IPV4:?error} traefik-log-dashboard.${DOMAINNAME:?error}
+          ${IPV6:?error} traefik-log-dashboard.${DOMAINNAME:?error}
       
-          ${IPV4:?error} beszel.${DOMAINNAME?error}
-          ${IPV6:?error} beszel.${DOMAINNAME?error}
+          ${IPV4:?error} beszel.${DOMAINNAME:?error}
+          ${IPV6:?error} beszel.${DOMAINNAME:?error}
       
-          ${IPV4:?error} ifxmetrics.${DOMAINNAME?error}
-          ${IPV6:?error} ifxmetrics.${DOMAINNAME?error}
+          ${IPV4:?error} ifxmetrics.${DOMAINNAME:?error}
+          ${IPV6:?error} ifxmetrics.${DOMAINNAME:?error}
       
-          ${IPV4:?error} asm.${DOMAINNAME?error}
-          ${IPV6:?error} asm.${DOMAINNAME?error}
+          ${IPV4:?error} asm.${DOMAINNAME:?error}
+          ${IPV6:?error} asm.${DOMAINNAME:?error}
       
-          ${IPV4:?error} dbs.${DOMAINNAME?error}
-          ${IPV6:?error} dbs.${DOMAINNAME?error}
+          ${IPV4:?error} dbs.${DOMAINNAME:?error}
+          ${IPV6:?error} dbs.${DOMAINNAME:?error}
       
           fallthrough
         }

From f06556339861f3425af643e7d2baebe5b18abe14 Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:03:32 +0200
Subject: [PATCH 09/20] security(grafana): caps

---
 docker/grafana/compose.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/docker/grafana/compose.yaml b/docker/grafana/compose.yaml
index e96e2ef..aaefa1c 100644
--- a/docker/grafana/compose.yaml
+++ b/docker/grafana/compose.yaml
@@ -5,6 +5,8 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
     depends_on:
       db:
         condition: "service_healthy"
@@ -35,6 +37,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     healthcheck:
       interval: "30s"
       retries: 5
@@ -57,6 +67,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     volumes:
       - "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/db-backups:/backup:z"
     environment:

From c32eb03f684829431a28682e177c4ae9b75e3b3a Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:03:43 +0200
Subject: [PATCH 10/20] security(fixmetrics): caps

---
 docker/ifxmetrics/compose.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docker/ifxmetrics/compose.yaml b/docker/ifxmetrics/compose.yaml
index 3a09f3a..0550159 100644
--- a/docker/ifxmetrics/compose.yaml
+++ b/docker/ifxmetrics/compose.yaml
@@ -5,6 +5,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     ports:
       - "8086:8086"
     networks:

From 6e6b2e9ce47acbff1691bdcad2c597aaa1f11dbc Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:03:53 +0200
Subject: [PATCH 11/20] security(komodo): caps

---
 docker/komodo/compose.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docker/komodo/compose.yaml b/docker/komodo/compose.yaml
index 623feae..399ce8e 100644
--- a/docker/komodo/compose.yaml
+++ b/docker/komodo/compose.yaml
@@ -8,6 +8,13 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "DAC_OVERRIDE"
     volumes:
       - "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/mongo-data:/data/db:z"
       - "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/mongo-config:/data/configdb:z"
@@ -33,6 +40,8 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
     depends_on:
       - "mongo"
     ports:

From e178af3ec0c33f70449353dc0bc8ad32f2aad6a0 Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:04:20 +0200
Subject: [PATCH 12/20] security(kopia): caps, command -> env, remove
 disable-csrf

---
 docker/kopia/compose.yaml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/docker/kopia/compose.yaml b/docker/kopia/compose.yaml
index d69342f..2744ada 100644
--- a/docker/kopia/compose.yaml
+++ b/docker/kopia/compose.yaml
@@ -8,16 +8,19 @@ services:
     security_opt:
       - "label:disable" # Disable SELinux labels for compatibility with Kopia
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "DAC_READ_SEARCH"
     command:
       - "server"
       - "start"
-      - "--disable-csrf-token-checks"
       - "--insecure"
       - "--address=0.0.0.0:51515"
-      - "--server-username=${SERVER_USERNAME?error}"
-      - "--server-password=${SERVER_PASSWORD?error}"
     environment:
       KOPIA_PASSWORD: "${REPOSITORY_PASSWORD:?error}"
+      KOPIA_SERVER_USERNAME: "${SERVER_USERNAME:?error}"
+      KOPIA_SERVER_PASSWORD: "${SERVER_PASSWORD:?error}"
       USER: "${USER:-kopia}"
       TZ: "Europe/Berlin"
     networks:

From 4e07f038c2ed78b351c8b4bb9792fa2d12f081c1 Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:04:49 +0200
Subject: [PATCH 13/20] security(website): caps, selinux

---
 docker/legacy-website-beta/compose.yaml | 23 ++++++++++++++++++++++-
 docker/legacy-website-prod/compose.yaml | 23 ++++++++++++++++++++++-
 2 files changed, 44 insertions(+), 2 deletions(-)

diff --git a/docker/legacy-website-beta/compose.yaml b/docker/legacy-website-beta/compose.yaml
index 85b1d01..845bd10 100644
--- a/docker/legacy-website-beta/compose.yaml
+++ b/docker/legacy-website-beta/compose.yaml
@@ -5,6 +5,12 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
     environment:
       TZ: "Europe/Berlin"
       APP_NAME: "Tactical Training Team | Arma MilSim Community"
@@ -35,7 +41,7 @@ services:
       traefik.http.routers.legacy-website-beta.service: "legacy-website-beta"
       traefik.http.services.legacy-website-beta.loadbalancer.server.port: 80
     volumes:
-      - "missions:/missions:Z"
+      - "missions:/missions:z"
     depends_on:
       db:
         condition: "service_healthy"
@@ -45,6 +51,13 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "DAC_OVERRIDE"
     environment:
       MARIADB_AUTO_UPGRADE: "1"
       MARIADB_DISABLE_UPGRADE_BACKUP: "1"
@@ -70,6 +83,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     volumes:
       - "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/db-backups:/backup:z"
     environment:
diff --git a/docker/legacy-website-prod/compose.yaml b/docker/legacy-website-prod/compose.yaml
index 0aee16a..f7be545 100644
--- a/docker/legacy-website-prod/compose.yaml
+++ b/docker/legacy-website-prod/compose.yaml
@@ -5,6 +5,12 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
     environment:
       TZ: "Europe/Berlin"
       APP_NAME: "Tactical Training Team | Arma MilSim Community"
@@ -38,7 +44,7 @@ services:
       traefik.http.middlewares.redirect-www-to-non-www.redirectregex.regex: "^https://www\\.(.*)"
       traefik.http.middlewares.redirect-www-to-non-www.redirectregex.replacement: "https://$$1"
     volumes:
-      - "missions:/missions:Z"
+      - "missions:/missions:z"
     depends_on:
       db:
         condition: "service_healthy"
@@ -49,6 +55,13 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "DAC_OVERRIDE"
     environment:
       MARIADB_AUTO_UPGRADE: "1"
       MARIADB_DISABLE_UPGRADE_BACKUP: "1"
@@ -74,6 +87,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     volumes:
       - "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/db-backups:/backup:z"
     environment:

From 69e380a031cac0b3ff2139db22fd1411ca0aeb2e Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:04:57 +0200
Subject: [PATCH 14/20] security(matomo): caps

---
 docker/matomo/compose.yaml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/docker/matomo/compose.yaml b/docker/matomo/compose.yaml
index 7109be3..f995b10 100644
--- a/docker/matomo/compose.yaml
+++ b/docker/matomo/compose.yaml
@@ -5,6 +5,12 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
     environment:
       MATOMO_DATABASE_HOST: "db"
       MATOMO_DATABASE_ADAPTER: "mysql"
@@ -33,6 +39,13 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "DAC_OVERRIDE"
     command:
       - "--max-allowed-packet=64MB"
     environment:
@@ -61,6 +74,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     volumes:
       - "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/db-backups:/backup:z"
     environment:

From 7072b0a46846bc8d20f7403e96558ed63e6a8620 Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:05:08 +0200
Subject: [PATCH 15/20] security(missions): caps

---
 docker/missions/compose.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docker/missions/compose.yaml b/docker/missions/compose.yaml
index 96e9419..6b0e3a8 100644
--- a/docker/missions/compose.yaml
+++ b/docker/missions/compose.yaml
@@ -6,6 +6,10 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "NET_BIND_SERVICE"
     volumes:
       - "./browse.html:/templates/browse.html:ro,Z"
       - "missions:/srv/mpmissions:ro"

From a197a4360aec563d4d2111cd246737c31a0b1a93 Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:05:37 +0200
Subject: [PATCH 16/20] security(nextcloud): caps, condition

---
 docker/nextcloud/compose.yaml | 47 ++++++++++++++++++++++++++++++++---
 1 file changed, 44 insertions(+), 3 deletions(-)

diff --git a/docker/nextcloud/compose.yaml b/docker/nextcloud/compose.yaml
index 0b8b500..d9a8997 100644
--- a/docker/nextcloud/compose.yaml
+++ b/docker/nextcloud/compose.yaml
@@ -5,6 +5,12 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
     environment:
       TZ: "Europe/Berlin"
       REDIS_HOST: "redis"
@@ -44,7 +50,7 @@ services:
       db:
         condition: "service_healthy"
       redis:
-        condition: "service_started"
+        condition: "service_healthy"
 
   cron:
     image: "nextcloud:34.0.2-apache"
@@ -53,6 +59,12 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
     environment:
       TZ: "Europe/Berlin"
     # volumes must be identical to the app container
@@ -65,7 +77,7 @@ services:
       db:
         condition: "service_healthy"
       redis:
-        condition: "service_started"
+        condition: "service_healthy"
 
   redis:
     image: "redis:8.8.1-alpine"
@@ -73,8 +85,22 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      start_period: "10s"
+      interval: "10s"
+      timeout: "5s"
+      retries: 3
     volumes:
-      - "redis:/data:Z"
+      - "redis:/data:z"
 
   db:
     image: "mariadb:lts"
@@ -83,6 +109,13 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "DAC_OVERRIDE"
     environment:
       MARIADB_AUTO_UPGRADE: "1"
       MARIADB_DISABLE_UPGRADE_BACKUP: "1"
@@ -108,6 +141,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     volumes:
       - "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/db-backups:/backup:z"
     environment:

From 83515929b228006c9eb4211de87bc9d218a7bbe8 Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:05:45 +0200
Subject: [PATCH 17/20] security(ocap): caps

---
 docker/ocap/compose.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docker/ocap/compose.yaml b/docker/ocap/compose.yaml
index b1f696e..5792c96 100644
--- a/docker/ocap/compose.yaml
+++ b/docker/ocap/compose.yaml
@@ -5,6 +5,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     environment:
       OCAP_SECRET: "${OCAP_SECRET:?error}"
       OCAP_CUSTOMIZE_ENABLED: "true"

From 704b214416d247d37085d0ad9de0e0d4faaa895a Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:05:54 +0200
Subject: [PATCH 18/20] security(steamoidc): caps

---
 docker/steam-oidc/compose.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docker/steam-oidc/compose.yaml b/docker/steam-oidc/compose.yaml
index 69e1e15..3f9334f 100644
--- a/docker/steam-oidc/compose.yaml
+++ b/docker/steam-oidc/compose.yaml
@@ -5,6 +5,8 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
     environment:
       TZ: "Europe/Berlin"
       OpenId__RedirectUri: "${REDIRECT_URI:?error}"

From 151a2c7d5e347cacf9fb881ef2fb315ef80a7ace Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:06:39 +0200
Subject: [PATCH 19/20] security(traefik): caps, openport 8090 dashboard, api
 insecure false

---
 docker/traefik/compose.yaml | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/docker/traefik/compose.yaml b/docker/traefik/compose.yaml
index 00c715a..b405c70 100644
--- a/docker/traefik/compose.yaml
+++ b/docker/traefik/compose.yaml
@@ -5,6 +5,12 @@ services:
     security_opt:
       - "label:disable"
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
     environment:
       CONTAINERS: 1
     volumes:
@@ -19,6 +25,10 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "NET_BIND_SERVICE"
     ports:
       - "${ENTRYPOINT_INTERNAL_IPV4:?error}:80:8080"
       - "${ENTRYPOINT_INTERNAL_IPV4:?error}:443:8443"
@@ -32,7 +42,6 @@ services:
       - "[${ENTRYPOINT_EXTERNAL_IPV6:?error}]:80:80"
       - "[${ENTRYPOINT_EXTERNAL_IPV6:?error}]:443:443"
       - "[${ENTRYPOINT_EXTERNAL_IPV6:?error}]:443:443/udp" # http3
-      - "8090:8090"
     healthcheck:
       test: [ 'CMD', 'traefik', 'healthcheck', '--ping' ]
     volumes:
@@ -52,7 +61,7 @@ services:
     labels:
       traefik.enable: true
       traefik.http.routers.traefik.entrypoints: "websecure-internal"
-      traefik.http.routers.traefik.rule: "Host(`traefik.${DOMAINNAME_1?error}`)"
+      traefik.http.routers.traefik.rule: "Host(`traefik.${DOMAINNAME_1:?error}`)"
       traefik.http.routers.traefik.service: "api@internal"
       traefik.http.routers.traefik.middlewares: "authentik"
       traefik.http.middlewares.xff2realip.plugin.traefik-xff-to-xrealip.depth: 0
@@ -63,6 +72,8 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
     networks:
       proxy:
     labels:
@@ -162,7 +173,7 @@ configs:
       
       api:
         dashboard: true
-        insecure: true
+        insecure: false
       
       ping: {}
       

From 6717a3bd59cf8d0fe15dd378245b98720ba3f7be Mon Sep 17 00:00:00 2001
From: MenomDE <menom@berlin.de>
Date: Tue, 28 Jul 2026 13:07:20 +0200
Subject: [PATCH 20/20] security(bot-nachrichtenoffizier): caps

---
 docker/bot-nachrichtenoffizier/compose.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docker/bot-nachrichtenoffizier/compose.yaml b/docker/bot-nachrichtenoffizier/compose.yaml
index 5f905a8..84863ce 100644
--- a/docker/bot-nachrichtenoffizier/compose.yaml
+++ b/docker/bot-nachrichtenoffizier/compose.yaml
@@ -5,6 +5,14 @@ services:
     restart: "unless-stopped"
     security_opt:
       - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "SETUID"
+      - "SETGID"
+      - "FOWNER"
+      - "DAC_OVERRIDE"
     environment:
       DISCORD_TOKEN: "${DISCORD_TOKEN:?error}"
       CLIENT_ID: "${CLIENT_ID:?error}"