fix(security): bind postgres to loopback

[Starling-spell]

Fixes #1603

What

• bind the Docker Compose PostgreSQL host port to 127.0.0.1
• keep DBHOSTPORT configurable for local tooling
• add a regression test that parses docker-compose.yml and enforces the loopback-only mapping

Why

The previous ${DBHOSTPORT:-5432}:5432 mapping caused Docker to publish PostgreSQL on every host interface. Combined with the development credentials, this exposed the database to unauthenticated internet attacks on publicly reachable hosts. Issue #1603 reports a real compromise that used this path to deploy a cryptominer.

The new mapping preserves host access for local development while preventing remote connections by default.

Testing done

• python -m pytest tests/unit/test_docker_compose_security.py -q — 1 passed
• git diff --check

Decisions made

• hard-code the loopback bind rather than adding an environment override, so the secure default cannot be accidentally disabled through inherited environment configuration
• retain the existing configurable host port

Checks

• I have tested this code
• I have reviewed my own PR
• I have created an issue for this PR (existing issue [CRITICAL] PostgreSQL Port Exposed to Public Internet Allows RCE and Cryptominer Deployment 🔴 #1603)
• I have set a descriptive PR title compliant with conventional commits

Reviewing tips

The functional change is the single port mapping in docker-compose.yml; the unit test protects that exact security invariant.

User facing release notes

PostgreSQL exposed by GenLayer Studio now listens on the local machine only by default, preventing accidental public database exposure on VPS and cloud hosts.

[github-actions]

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.123-dev, the active development branch. Pushes to v0.123-dev automatically fast-forward main.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 550e6bf0-5f78-4483-b3cb-db671082ab12

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}