Security and infrastructure improvements

[anonfedora]

Security and Infrastructure Improvements

This PR addresses critical security and infrastructure issues across the codebase, implementing Content Security Policy, Docker hardening, removing hardcoded secrets, and adding health checks.

Changes Made

#990 - Implement strict Content Security Policy with nonce-based script loading

• Added strict CSP headers in frontend/next.config.ts with nonce-based script loading
• Configured security headers: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy
• Added nonce attribute to inline theme initialization script in frontend/src/app/layout.tsx
• CSP includes: default-src 'self', script-src with nonce, style-src with nonce, img-src with data/https/blob:, connect-src with https/ws/wss, and other restrictive policies

#973 - Review and fix backend Dockerfile for production readiness

• Created non-root user (nodejs:1001) for security
• Added HEALTHCHECK instruction with proper configuration (30s interval, 10s timeout, 3 retries, 40s start period)
• Changed ownership of /app directory to non-root user
• Switched to non-root user before running the application
• Multi-stage build already implemented (builder + production stages)

#978 - Audit and fix hardcoded secrets, ports, and URLs throughout codebase

• Updated docker-compose.yml to use environment variables for all sensitive values:
  • POSTGRES_PASSWORD, POSTGRES_USER, POSTGRES_PORT
  • JWT_SECRET, BACKEND_URL, FRONTEND_URL
• Updated .env.example files to use CHANGE_THIS_* placeholders instead of default secrets
• Removed duplicate JWT_SECRET section in backend/.env.example
• Added validation in backend code to throw errors when required environment variables are missing:
  • REDIS_URL in utils/redis.ts, config/env.config.ts, and all queue/worker files
  • WEBHOOK_SIGNING_SECRET and WEBHOOK_INGEST_SECRET in webhook routes and worker
• Replaced all redis://localhost:6379 fallbacks with error-throwing functions

#979 - Add healthcheck to backend service in Docker Compose

• Added healthcheck to backend service in docker-compose.yml
• Uses /health endpoint for health verification
• Configured with: 30s interval, 10s timeout, 3 retries, 40s start period
• Ensures dependent services wait for backend to be healthy

Additional Fixes

• Regenerated Prisma client to resolve webhookSubscription type errors
• Installed missing AWS SDK dependencies (@aws-sdk/client-s3, @aws-sdk/lib-storage)

Testing

• All environment variable validations tested
• Dockerfile builds successfully with non-root user
• Healthcheck endpoint verified in docker-compose configuration

Closes #990
Closes #973
Closes #978
Closes #979

[vercel]

@anonfedora is attempting to deploy a commit to the Ayomide Adeniran's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@anonfedora Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[ayomideadeniran]

Pr under review.