Harden code-server and move Redis password to secret file

Harden code-server and move Redis password to secret file

infra/redis/docker-compose.yml

@@ -3,15 +3,21 @@ services:
     image: redis:7-alpine
     container_name: Redis
     restart: unless-stopped
-
-    command: redis-server --appendonly yes --requirepass kuchen098765
+    command:
+      - sh
+      - -c
+      - exec redis-server --appendonly yes --requirepass "$$(cat /run/secrets/redis_password)"
 
     volumes:
       - /mnt/user/appdata/redis:/data
+      - /mnt/user/appdata/secrets/redis_password.txt:/run/secrets/redis_password:ro
 
     networks:
       - backend_net
 
+    security_opt:
+      - no-new-privileges:true
+
 networks:
   backend_net:
-    external: true
+    external: true