production hardening: future-date guard, per-day hour cap, totalHours in history, header cleanup

docker/.env

@@ -2,5 +2,5 @@ DB_PASSWORD=coastal_secret
 JWT_SECRET=Ts8pLm3QvK5nRw9sYzB4jFc7hE0aGd2U
 JWT_REFRESH_SECRET=Rf6kMn2QpT8wLs4vYzA7jFb9hD0eGc5U
 NODE_ENV=production
-CORS_ORIGINS=https://ts.bizzle.cloud
+CORS_ORIGINS=https://ts.bizzle.cloud,http://localhost:5173,http://localhost:3000
 ENABLE_BACKUPS=false

docker/docker-compose.yml

@@ -7,7 +7,7 @@ services:
     restart: unless-stopped
     environment:
       POSTGRES_USER: coastal
-      POSTGRES_PASSWORD: ${DB_PASSWORD:-coastal_secret}
+      POSTGRES_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD must be set in .env}
       POSTGRES_DB: coastal_timesheet
     volumes:
       - pgdata:/var/lib/postgresql/data
@@ -34,12 +34,12 @@ services:
       db:
         condition: service_healthy
     environment:
-      DATABASE_URL: postgresql://coastal:${DB_PASSWORD:-coastal_secret}@db:5432/coastal_timesheet
-      JWT_SECRET: ${JWT_SECRET:-change-me-in-production-jwt-secret-2026}
-      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET:-change-me-in-production-refresh-secret-2026}
+      DATABASE_URL: postgresql://coastal:${DB_PASSWORD:?DB_PASSWORD must be set}@db:5432/coastal_timesheet
+      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set in .env}
+      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET:?JWT_REFRESH_SECRET must be set in .env}
       PORT: '3004'
       NODE_ENV: production
-      CORS_ORIGINS: https://ts.bizzle.cloud,http://localhost
+      CORS_ORIGINS: https://ts.bizzle.cloud,http://localhost:5173,http://localhost:3000
       SMTP_HOST: ${SMTP_HOST:-}
       SMTP_PORT: ${SMTP_PORT:-587}
       SMTP_USER: ${SMTP_USER:-}
@@ -47,8 +47,7 @@ services:
       SMTP_FROM: ${SMTP_FROM:-}
       ADMIN_EMAIL: ${ADMIN_EMAIL:-bizzle@coastalcontracting.com}
     ports:
-      - '127.0.0.1:3004:3004'
-      - '172.18.0.1:3004:3004'
+      - '127.0.0.1:3005:3004'
     healthcheck:
       test: ['CMD', 'node', '-e', "fetch('http://localhost:3004/api/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"]
       interval: 15s

docker/nginx/default.conf

@@ -12,11 +12,9 @@ server {
     listen [::]:80;
     server_name _;
 
-    # Security headers
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Content-Type-Options "nosniff" always;
+    # Security headers (X-Frame-Options, HSTS, X-Content-Type-Options set by Caddy)
     add_header X-XSS-Protection "0" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
 
     # Gzip compression
     gzip on;