fix(security): complete security and delivery compliance remediation

deploy/docker-compose.yml

@@ -6,7 +6,7 @@ services:
       dockerfile: Dockerfile
     container_name: h3c-onu-ms-backend
     ports:
-      - "8001:8000"
+      - "${BACKEND_PORT:-8001}:8000"
     environment:
       - DATABASE_URL=${DATABASE_URL}
       - REDIS_URL=${REDIS_URL}
@@ -17,7 +17,9 @@ services:
       - CASDOOR_ORG_NAME=${CASDOOR_ORG_NAME}
       - CASDOOR_APP_NAME=${CASDOOR_APP_NAME}
       - CASDOOR_REDIRECT_URL=${CASDOOR_REDIRECT_URL:-}
+      - CASDOOR_ISSUER=${CASDOOR_ISSUER:-}
       - SECRET_KEY=${SECRET_KEY}
+      - CREDENTIAL_ENCRYPTION_KEY=${CREDENTIAL_ENCRYPTION_KEY}
       - DEBUG=${DEBUG:-false}
       - CORS_ORIGINS=${CORS_ORIGINS:-}
       - FRONTEND_URL=${FRONTEND_URL:-https://onu.dhdx.fun}
@@ -60,7 +62,9 @@ services:
       - CASDOOR_CERTIFICATE=${CASDOOR_CERTIFICATE}
       - CASDOOR_ORG_NAME=${CASDOOR_ORG_NAME}
       - CASDOOR_APP_NAME=${CASDOOR_APP_NAME}
+      - CASDOOR_ISSUER=${CASDOOR_ISSUER:-}
       - SECRET_KEY=${SECRET_KEY}
+      - CREDENTIAL_ENCRYPTION_KEY=${CREDENTIAL_ENCRYPTION_KEY}
       - WECHAT_CORPID=${WECHAT_CORPID:-}
       - WECHAT_CORPSECRET=${WECHAT_CORPSECRET:-}
       - WECHAT_AGENTID=${WECHAT_AGENTID:-}
@@ -90,7 +94,9 @@ services:
       - CASDOOR_CERTIFICATE=${CASDOOR_CERTIFICATE}
       - CASDOOR_ORG_NAME=${CASDOOR_ORG_NAME}
       - CASDOOR_APP_NAME=${CASDOOR_APP_NAME}
+      - CASDOOR_ISSUER=${CASDOOR_ISSUER:-}
       - SECRET_KEY=${SECRET_KEY}
+      - CREDENTIAL_ENCRYPTION_KEY=${CREDENTIAL_ENCRYPTION_KEY}
       - WECHAT_CORPID=${WECHAT_CORPID:-}
       - WECHAT_CORPSECRET=${WECHAT_CORPSECRET:-}
       - WECHAT_AGENTID=${WECHAT_AGENTID:-}
@@ -111,12 +117,12 @@ services:
       dockerfile: Dockerfile
     container_name: h3c-onu-ms-frontend
     ports:
-      - "18062:80"
+      - "${FRONTEND_PORT:-18062}:80"
     depends_on:
       - backend
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:80/health"]
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:80/health"]
       interval: 30s
       timeout: 10s
       retries: 3