fix(security): bind postgres to loopback

docker-compose.yml

@@ -257,7 +257,7 @@ services:
     profiles: ["ollama"]
     image: ollama/ollama:0.17.6
     ports:
-      - 11434:11434
+      - "127.0.0.1:11434:11434"
     volumes:
       - ./.ollama:/root/.ollama
     container_name: ollama
@@ -275,7 +275,7 @@ services:
     image: postgres:16-alpine
     command: sh -c "if [ \"$REMOTE_DATABASE\" = \"true\" ]; then echo 'Postgres disabled in hosted environment' && exec tail -f /dev/null; else exec docker-entrypoint.sh postgres; fi"
     ports:
-      - "${DBHOSTPORT:-5432}:5432"
+      - "127.0.0.1:${DBHOSTPORT:-5432}:5432"
     environment:
       - POSTGRES_USER=${DBUSER}
       - POSTGRES_PASSWORD=${DBPASSWORD}
@@ -429,7 +429,7 @@ services:
   redis:
     image: redis:8-alpine
     ports:
-      - "${REDISPORT:-6379}:6379"
+      - "127.0.0.1:${REDISPORT:-6379}:6379"
     volumes:
       - redis_data:/data
     healthcheck:

tests/unit/test_docker_compose_security.py

@@ -0,0 +1,25 @@
+from pathlib import Path
+
+import yaml
+
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
+
+
+def _compose_ports(service: str) -> list[str]:
+    compose = yaml.safe_load(
+        (REPOSITORY_ROOT / "docker-compose.yml").read_text(encoding="utf-8")
+    )
+    return compose["services"][service]["ports"]
+
+
+def test_postgres_is_bound_to_loopback_by_default():
+    assert _compose_ports("postgres") == ["127.0.0.1:${DBHOSTPORT:-5432}:5432"]
+
+
+def test_redis_is_bound_to_loopback_by_default():
+    assert _compose_ports("redis") == ["127.0.0.1:${REDISPORT:-6379}:6379"]
+
+
+def test_ollama_is_bound_to_loopback_by_default():
+    assert _compose_ports("ollama") == ["127.0.0.1:11434:11434"]