Add manual repo policy checks

2026-05-06 19:36:01 +02:00
parent 0aa8138bdd
commit 7c50e69b44
4 changed files with 531 additions and 0 deletions
@@ -0,0 +1,29 @@
+# Policy Check Report
+
+## Summary
+- Compose files checked: 30
+- Critical findings: 0
+- Warnings: 5
+- Info findings: 9
+
+## Critical
+- none
+
+## Warnings
+- [SEC001] infra\ddns-updater\docker-compose.yml :: ddns-updater: Missing security_opt no-new-privileges:true.
+- [SEC001] ops\backrest\docker-compose.yml :: backrest: Missing security_opt no-new-privileges:true.
+- [USER001] ops\grafana-influxdb\docker-compose.yml :: grafana: Runs as user 0. Documented exception, keep visible for hardening.
+- [USER001] ops\grafana-influxdb\docker-compose.yml :: influxdb3-core: Runs as user 0. Documented exception, keep visible for hardening.
+- [SEC001] ops\scrutiny\docker-compose.yml :: scrutiny: Missing security_opt no-new-privileges:true.
+
+## Info
+- [PORT001] core\gitea\docker-compose.yml :: gitea: Allowed host port mapping: 222:22
+- [PORT001] host-services\Adguard\docker-compose.yml :: adguard: Allowed host port mapping: 53:53/tcp
+- [PORT001] host-services\Adguard\docker-compose.yml :: adguard: Allowed host port mapping: 53:53/udp
+- [PORT001] host-services\Adguard\docker-compose.yml :: adguard: Allowed host port mapping: 8082:80
+- [HOSTNET001] host-services\tailscale\docker-compose.yml :: tailscale: network_mode: host is a documented exception.
+- [PORT001] ops\grafana-influxdb\docker-compose.yml :: influxdb3-core: Allowed host port mapping: ${INFLUXDB_BIND_IP:-127.0.0.1}:8181:8181
+- [PRIV001] ops\scrutiny\docker-compose.yml :: scrutiny: Privileged mode is a documented exception.
+- [PORT001] traefik\docker-compose.yml :: traefik: Allowed host port mapping: 80:80
+- [PORT001] traefik\docker-compose.yml :: traefik: Allowed host port mapping: 443:443
+