Harden deployment, bootstrap credentials, and release integrity

.loupe/scanner-config.json

@@ -0,0 +1,13 @@
+{
+  "max_concurrent_files": 1,
+  "include_extensions": ["js", "mjs", "ts", "tsx"],
+  "extra_source_paths": [
+    "src",
+    "scripts/create-four-node-devnet.mjs",
+    "Dockerfile",
+    "docker-compose.yml",
+    "docker-compose.portainer.yml",
+    "docker/caddy/Caddyfile",
+    "vite.config.ts"
+  ]
+}

Dockerfile

@@ -2,7 +2,7 @@ FROM node:20-bookworm-slim AS build
 
 WORKDIR /app
 COPY package*.json ./
-RUN npm install
+RUN npm ci
 
 COPY . .
 RUN npm run build
@@ -15,11 +15,12 @@ ENV NODE_ENV=production
 ENV PORT=8787
 ENV DATA_DIR=/app/data
 
-COPY --from=build /app/package.json ./package.json
-COPY --from=build /app/node_modules ./node_modules
-COPY --from=build /app/dist ./dist
+COPY --from=build --chown=node:node /app/package.json ./package.json
+COPY --from=build --chown=node:node /app/node_modules ./node_modules
+COPY --from=build --chown=node:node /app/dist ./dist
 
-RUN mkdir -p /app/data
+RUN install -d -o node -g node -m 700 /app/data
 
 EXPOSE 8787
+USER node
 CMD ["node", "dist/server/server/index.js"]

docker-compose.portainer.yml

@@ -8,13 +8,17 @@ services:
       NODE_ENV: production
       TZ: ${TZ:-Etc/UTC}
       PORT: 8787
+      TRUST_PROXY_HOPS: 1
       DATA_DIR: /app/data
       APP_SECRET: ${APP_SECRET:?Set APP_SECRET in the Portainer stack environment}
       COOKIE_SECURE: "true"
+      PUBLIC_BASE_URL: https://${TESTNET_HOST:-testnet.zenon.info}
       GO_ZENON_REPO: ${GO_ZENON_REPO:-https://github.com/zenon-network/go-zenon.git}
       GO_ZENON_REF: ${GO_ZENON_REF:-master}
+      GO_ZENON_COMMIT: ${GO_ZENON_COMMIT:-}
       DEPLOYMENT_REPO: ${DEPLOYMENT_REPO:-https://github.com/hypercore-one/deployment.git}
       DEPLOYMENT_REF: ${DEPLOYMENT_REF:-main}
+      DEPLOYMENT_COMMIT: ${DEPLOYMENT_COMMIT:-}
     volumes:
       - zenon_testnet_builder_data:/app/data
     expose:

docker-compose.yml

@@ -6,10 +6,14 @@ services:
       APP_SECRET: ${APP_SECRET:?Set APP_SECRET before starting the stack}
       DATA_DIR: /app/data
       PORT: 8787
+      TRUST_PROXY_HOPS: 1
+      PUBLIC_BASE_URL: http://127.0.0.1:${HTTP_PORT:-8080}
       GO_ZENON_REPO: ${GO_ZENON_REPO:-https://github.com/zenon-network/go-zenon.git}
       GO_ZENON_REF: ${GO_ZENON_REF:-master}
+      GO_ZENON_COMMIT: ${GO_ZENON_COMMIT:-}
       DEPLOYMENT_REPO: ${DEPLOYMENT_REPO:-https://github.com/hypercore-one/deployment.git}
       DEPLOYMENT_REF: ${DEPLOYMENT_REF:-main}
+      DEPLOYMENT_COMMIT: ${DEPLOYMENT_COMMIT:-}
     volumes:
       - testnet-data:/app/data
 
@@ -19,7 +23,7 @@ services:
     depends_on:
       - app
     ports:
-      - "${HTTP_PORT:-8080}:80"
+      - "127.0.0.1:${HTTP_PORT:-8080}:80"
     volumes:
       - ./docker/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
       - caddy-data:/data

docs/loupe-security-scanning.md

@@ -0,0 +1,75 @@
+# Loupe Security Scanning
+
+This repository carries a Project Loupe scanner profile at
+`.loupe/scanner-config.json`. The profile covers the TypeScript application
+and the operational files that automatic package-root discovery would not
+normally include, especially the devnet wallet-generation script, container
+definitions, Caddy configuration, and Vite configuration.
+
+The profile relies on per-repository scanner configuration, including
+`extra_source_paths`. Use the compatible Loupe fork at
+`https://github.com/edgepillar/loupe.git`, pinned to commit
+`5c8744c1b2823415fe851d17bae92ff8f7193a15`. Do not silently substitute a
+Loupe revision that does not implement these scanner fields.
+
+## Register the repository
+
+Run these commands from a checkout of this repository after the Loupe server,
+worker, and `loupectl` client are configured:
+
+```bash
+loupectl repo add \
+  --clone-url https://github.com/0x3639/testnet.git \
+  --branch main \
+  --scanner-config-file .loupe/scanner-config.json \
+  --no-reporting \
+  --verification-enabled \
+  --require-approval
+```
+
+The safe initial policy is deliberate:
+
+- `max_concurrent_files` remains `1` to bound provider usage and keep the pilot
+  deliberately serial. Increase it only after reviewing measured usage and
+  scan behavior.
+- `--no-reporting` keeps findings in Loupe for manual triage until a tracker
+  repository and scoped GitHub token are selected.
+- `--verification-enabled` asks a second agent to validate each candidate.
+- `--require-approval` prevents a confirmed finding from being dispatched
+  without an operator decision.
+- No scan interval is set, so the first runs are explicitly controlled and
+  their provider usage can be observed.
+
+The command prints the assigned repository ID. Start the baseline scan with:
+
+```bash
+loupectl repo scan <repo-id>
+```
+
+Inspect progress and results with:
+
+```bash
+loupectl job list
+loupectl finding list <repo-id>
+loupectl finding show <finding-id>
+```
+
+After the baseline completes, scan later changes incrementally:
+
+```bash
+loupectl repo scan <repo-id> --incremental
+```
+
+## Profile lifecycle
+
+Loupe stores the scanner JSON when the repository is registered. If
+`.loupe/scanner-config.json` changes, reload it without discarding prior jobs
+or findings:
+
+```bash
+loupectl repo update <repo-id> \
+  --scanner-config-file .loupe/scanner-config.json
+```
+
+Do not put Loupe credentials, API keys, GitHub tokens, wallet material, or
+testnet operator secrets in this profile.