- Clear default passwords in all service configs, require env vars
- Add JWT auth + role middleware to WebSocket endpoints
- Add origin whitelist to WebSocket upgrader (CORS protection)
- Fix goroutine leak in WS proxy (double errCh read)
- Update docker-compose to require secrets via ${VAR:?...} syntax
- Mark deprecated k8s configmap passwords as REPLACE_AT_DEPLOY_TIME
Co-Authored-By: Claude <noreply@anthropic.com>
Alpine CDN (dl-cdn.alpinelinux.org) unreachable from DinD containers.
Switch to mirrors.aliyun.com for apk package downloads.
Co-Authored-By: Claude <noreply@anthropic.com>
Docker Hub and proxy.golang.org are unreachable from k3s cluster
(GFW). Switch all Dockerfiles to pull base images from Harbor
(harbor-in-k3s.cheverjohn.me/library/) and use goproxy.cn for
Go module downloads.
Co-Authored-By: Claude <noreply@anthropic.com>