feat: harden authenticated deployment

docker-compose.yml

@@ -6,8 +6,16 @@ services:
       DATABASE_URL: postgresql://roast:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@db:5432/roast
       APP_ORIGIN: https://roast.srmr.xyz
       COOKIE_SECURE: "true"
-      BOOTSTRAP_SETUP_TOKEN: ${BOOTSTRAP_SETUP_TOKEN:?set a one-time random token}
-    depends_on: [db]
+      # Optional after the one-time administrator bootstrap has completed.
+      BOOTSTRAP_SETUP_TOKEN: ${BOOTSTRAP_SETUP_TOKEN:-}
+      # Leave unset unless a known reverse-proxy address/CIDR is configured.
+      TRUST_PROXY: ${TRUST_PROXY:-}
+    volumes:
+      # Mount only non-secret Pi agent model/auth configuration; keep it read-only.
+      - ${PI_AGENT_CONFIG_DIR:-./appdata/pi-agent}:/home/node/.pi/agent:ro
+    depends_on:
+      db:
+        condition: service_healthy
     expose: ["8090"]
     restart: unless-stopped
   db:
@@ -17,6 +25,11 @@ services:
       POSTGRES_USER: roast
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
     volumes: [postgres-data:/var/lib/postgresql/data]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U roast -d roast"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
     restart: unless-stopped
 volumes:
   postgres-data: