fix: address project review findings

Security and robustness:
- storage-agent rejects an empty INTERNAL_TOKEN (config notEmpty + middleware)
- api takes the client IP only from X-Real-IP (chi RealIP trusted True-Client-IP)
- /readyz reports ok/fail and logs the cause; checks run in parallel with a timeout
- storage-agent shuts down gracefully; shared httpx.NewServer/Serve with IdleTimeout
- goose migrations take a Postgres advisory lock
- recommender readyz: per-check timeout, redis socket timeouts

Clients:
- Android release allows cleartext HTTP for LAN servers (expo-build-properties)
- checkServer times out after 10s; connect button is disabled while checking

Deploy and CI:
- install.sh hands cache/uploads/updates/models to the non-root service users
- update.sh refuses downgrades unless PIPU_ALLOW_DOWNGRADE=1
- recommender/analyzer get only the env they need; required secrets fail fast
- nginx security headers and CSP; strip True-Client-IP
- dev compose binds ports to 127.0.0.1; postgres/redis images pinned
- version.mjs fails on a malformed explicit tag instead of releasing 0.0.0-dev
- contract check catches untracked generated files
- final releases fail without a release keystore; changelog skips rc tags

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/compose.dev.yaml

@@ -3,16 +3,17 @@
 #   docker compose -f deploy/compose.dev.yaml --profile app up  # + api и recommender из исходников
 # Затем: веб — `pnpm --filter @pipu/web dev` (проксирует /api на :8080),
 #        api без docker — см. README, раздел «Разработка».
+# Порты слушают только 127.0.0.1: у Redis нет пароля, а у dev-Postgres он известен всем.
 name: pipu-dev
 
 services:
   postgres:
-    image: pgvector/pgvector:pg17
+    image: pgvector/pgvector:0.8.7-pg17
     environment:
       POSTGRES_USER: pipu
       POSTGRES_PASSWORD: pipu
       POSTGRES_DB: pipu
-    ports: ["5432:5432"]
+    ports: ["127.0.0.1:5432:5432"]
     volumes: [pg-data:/var/lib/postgresql/data]
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U pipu -d pipu"]
@@ -20,8 +21,8 @@ services:
       retries: 10
 
   redis:
-    image: redis:7-alpine
-    ports: ["6379:6379"]
+    image: redis:7.4-alpine
+    ports: ["127.0.0.1:6379:6379"]
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 5s
@@ -32,7 +33,7 @@ services:
     environment:
       MEILI_MASTER_KEY: dev-master-key-change-me
       MEILI_ENV: development
-    ports: ["7700:7700"]
+    ports: ["127.0.0.1:7700:7700"]
     volumes: [meili-data:/meili_data]
 
   api:
@@ -45,7 +46,7 @@ services:
       DATABASE_URL: postgres://pipu:pipu@postgres:5432/pipu?sslmode=disable
       REDIS_URL: redis://redis:6379/0
       LOG_LEVEL: debug
-    ports: ["8080:8080"]
+    ports: ["127.0.0.1:8080:8080"]
     depends_on:
       postgres: { condition: service_healthy }
       redis: { condition: service_healthy }
@@ -59,7 +60,7 @@ services:
       DATABASE_URL: postgresql://pipu:pipu@postgres:5432/pipu
       REDIS_URL: redis://redis:6379/0
       INTERNAL_TOKEN: dev-internal-token
-    ports: ["8000:8000"]
+    ports: ["127.0.0.1:8000:8000"]
     depends_on:
       postgres: { condition: service_healthy }
       redis: { condition: service_healthy }

deploy/compose.yaml

@@ -45,7 +45,7 @@ services:
       args: *version
     env_file: .env
     environment: &db-env
-      DATABASE_URL: postgres://pipu:${POSTGRES_PASSWORD}@postgres:5432/pipu?sslmode=disable
+      DATABASE_URL: postgres://pipu:${POSTGRES_PASSWORD:?заполните POSTGRES_PASSWORD в .env (sudo ./install.sh)}@postgres:5432/pipu?sslmode=disable
     volumes:
       - *library-ro
       - ${PIPU_DATA:-/srv/pipu}/cache:/cache
@@ -67,8 +67,9 @@ services:
     cap_add: [SYS_ADMIN]
     security_opt: ["apparmor:unconfined"]
     environment:
-      INTERNAL_TOKEN: ${INTERNAL_TOKEN}
+      INTERNAL_TOKEN: ${INTERNAL_TOKEN:?заполните INTERNAL_TOKEN в .env (sudo ./install.sh)}
       LIBRARY_ROOT: /library
+      LOG_LEVEL: ${LOG_LEVEL:-info}
     volumes:
       - type: bind
         source: ${PIPU_DATA:-/srv/pipu}/library
@@ -81,8 +82,12 @@ services:
     image: pipu-music-recommender:${PIPU_VERSION:-dev}
     build: *build-rec
     command: ["serve"]
-    env_file: .env
-    environment: *db-env
+    # только нужные переменные, а не весь .env с секретами Meilisearch и Gitea
+    environment:
+      <<: *db-env
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
+      INTERNAL_TOKEN: ${INTERNAL_TOKEN:?заполните INTERNAL_TOKEN в .env (sudo ./install.sh)}
+      LOG_LEVEL: ${LOG_LEVEL:-info}
     depends_on:
       postgres: { condition: service_healthy }
 
@@ -91,8 +96,10 @@ services:
     image: pipu-music-recommender:${PIPU_VERSION:-dev}
     build: *build-rec
     command: ["analyze", "--workers", "4"]
-    env_file: .env
-    environment: *db-env
+    environment:
+      <<: *db-env
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
+      LOG_LEVEL: ${LOG_LEVEL:-info}
     volumes:
       - *library-ro
       - ${PIPU_DATA:-/srv/pipu}/models:/models
@@ -102,7 +109,7 @@ services:
 
   postgres:
     <<: *restart
-    image: pgvector/pgvector:pg17
+    image: pgvector/pgvector:0.8.7-pg17
     environment:
       POSTGRES_USER: pipu
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
@@ -115,7 +122,7 @@ services:
 
   redis:
     <<: *restart
-    image: redis:7-alpine
+    image: redis:7.4-alpine
     command: ["redis-server", "--appendonly", "yes"]
     volumes: [ "${PIPU_DATA:-/srv/pipu}/redis:/data" ]
 

deploy/install.sh

@@ -12,6 +12,11 @@ DATA="${PIPU_DATA:-/srv/pipu}"
 echo "→ каталоги в $DATA"
 mkdir -p "$DATA"/{library,library-host,cache/transcode,cache/covers,postgres,meili,redis,models,updates,uploads,backups,caddy/data,caddy/config}
 
+# Каталоги, куда пишут сервисы без root: api (distroless nonroot, uid 65532) и analyzer (uid 10001).
+# Без рекурсии: файлы внутри создают сами сервисы, а повторный запуск не обходит весь кэш.
+chown 65532:65532 "$DATA"/{cache,cache/transcode,cache/covers,updates,uploads}
+chown 10001:10001 "$DATA/models"
+
 # storage-agent монтирует NFS внутрь $DATA/library; чтобы точки монтирования видели другие контейнеры,
 # каталог должен быть отдельной точкой монтирования с shared propagation.
 if ! findmnt -n "$DATA/library" >/dev/null 2>&1; then
@@ -30,7 +35,7 @@ Before=docker.service
 
 [Service]
 Type=oneshot
-ExecStart=/bin/sh -c 'findmnt -n $DATA/library || mount --bind $DATA/library $DATA/library; mount --make-rshared $DATA/library'
+ExecStart=/bin/sh -c 'findmnt -n "$DATA/library" || mount --bind "$DATA/library" "$DATA/library"; mount --make-rshared "$DATA/library"'
 RemainAfterExit=yes
 
 [Install]

deploy/nginx/default.conf.template

@@ -26,6 +26,8 @@ server {
     root /usr/share/nginx/html;
     client_max_body_size 16m;
 
+    include /etc/nginx/snippets/security-headers.conf;
+
     gzip on;
     gzip_types text/css application/javascript application/json image/svg+xml;
 
@@ -37,6 +39,8 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $pipu_scheme;
+        # api берёт IP клиента только из X-Real-IP; остальные заголовки клиент может подделать
+        proxy_set_header True-Client-IP "";
     }
 
     location = /healthz { proxy_pass http://pipu_api; }
@@ -50,11 +54,13 @@ server {
 
     location /assets/ {
         expires 1y;
+        include /etc/nginx/snippets/security-headers.conf;
         add_header Cache-Control "public, immutable";
         try_files $uri =404;
     }
 
     location / {
+        include /etc/nginx/snippets/security-headers.conf;
         add_header Cache-Control "no-cache";
         try_files $uri $uri/ /index.html;
     }

deploy/nginx/security-headers.conf

@@ -0,0 +1,6 @@
+# Заголовки безопасности для SPA. Подключается через include: add_header внутри location
+# отменяет унаследованные с уровня server, поэтому include повторяется там, где есть свои add_header.
+add_header X-Content-Type-Options "nosniff" always;
+add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+add_header X-Frame-Options "DENY" always;
+add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;

deploy/update.sh

@@ -26,6 +26,23 @@ elif [[ "$REF" =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]]; then
   REF="v$REF"
 fi
 
+# Откат на более старую версию: миграции БД назад не применяются, старый api может не понять новую схему.
+CURRENT="$(sed -n 's/^PIPU_VERSION=//p' .env)"
+TARGET="${REF#v}"
+core() { [[ "$1" =~ ^([0-9]+\.[0-9]+\.[0-9]+) ]] && echo "${BASH_REMATCH[1]}"; }
+cur_core="$(core "$CURRENT" || true)"
+tgt_core="$(core "$TARGET" || true)"
+# сравниваем только MAJOR.MINOR.PATCH: переход 0.2.0-rc.1 → 0.2.0 откатом не считается
+if [ -n "$cur_core" ] && [ -n "$tgt_core" ] && [ "$cur_core" != "$tgt_core" ] &&
+  [ "$(printf '%s\n%s\n' "$cur_core" "$tgt_core" | sort -V | head -1)" = "$tgt_core" ]; then
+  echo "внимание: $CURRENT → $TARGET — это откат. Миграции БД не откатываются;" >&2
+  echo "  сделайте резервную копию (docs/deployment.md) и проверьте, что старая версия совместима со схемой." >&2
+  if [ "${PIPU_ALLOW_DOWNGRADE:-}" != 1 ]; then
+    echo "  Чтобы продолжить: PIPU_ALLOW_DOWNGRADE=1 ./update.sh $REF" >&2
+    exit 1
+  fi
+fi
+
 echo "→ переключаемся на $REF"
 if git show-ref --verify --quiet "refs/remotes/origin/$REF"; then
   git checkout --quiet "$REF"