Fix: Harden RPC bounds, monitoring credentials, and image fallbacks

.env.example

@@ -39,11 +39,30 @@ OP_NODE__RPC_TYPE=basic
 # For ink-mainnet, switch this to https://rpc-gel.inkonchain.com
 HEALTHCHECK__REFERENCE_RPC_PROVIDER=https://rpc-gel-sepolia.inkonchain.com
 
+# Bind host-published HTTP and monitoring services to loopback by default.
+# Use a private interface or an authenticated reverse proxy only when remote
+# access is explicitly required.
+HOST_BIND_ADDRESS=127.0.0.1
+
+# Grafana requires a non-empty password that is unique to this deployment.
+GRAFANA_ADMIN_USER=admin
+GRAFANA_ADMIN_PASSWORD=
+
+# InfluxDB requires separate admin, write, and read credentials. Use unique
+# values and store this file outside version control.
+INFLUXDB_ADMIN_USER=admin
+INFLUXDB_ADMIN_PASSWORD=
+INFLUXDB_WRITE_USER=opgeth_writer
+INFLUXDB_WRITE_USER_PASSWORD=
+INFLUXDB_READ_USER=grafana_reader
+INFLUXDB_READ_USER_PASSWORD=
+
 ###############################################################################
-#                                ↓ OPTIONAL ↓                                 #
+#                           ↓ OPTIONAL / REQUIRED ↓                            #
 ###############################################################################
 
-# Optional image tag overrides for sidecars
+# Required sidecar image tags. Use explicit immutable version tags rather
+# than latest or floating major/minor tags, and review updates deliberately.
 IMAGE_TAG__HEALTHCHECK=
 IMAGE_TAG__PROMETHEUS=
 IMAGE_TAG__GRAFANA=
@@ -62,6 +81,14 @@ PORT__OP_GETH_P2P=
 PORT__OP_NODE_P2P=
 PORT__OP_NODE_HTTP=
 
+# The following RPC controls override the restrictive defaults in the op-geth
+# entrypoint. Keep them restrictive unless a specific, reviewed client needs a
+# broader policy.
+OP_GETH_HTTP_CORS_DOMAIN=
+OP_GETH_HTTP_VHOSTS=
+OP_GETH_HTTP_API=
+OP_GETH_AUTHRPC_VHOSTS=
+
 # Advanced wrapper inputs shared by the shell entrypoints. Leave blank unless
 # you know you need them.
 # OVERRIDE_HOLOCENE appends --override.holocene=<value> in both wrappers.

.github/workflows/securesdlc.yml

@@ -1,20 +1,20 @@
-name: Nautilus SecureSDLC Reusable
-run-name: "[Nautilus SecureSDLC Reusable] Ref:${{ github.ref_name }} Event:${{ github.event_name }}"
-
-on:
-  workflow_dispatch: {}
-  workflow_call: {}
-  push:
-    branches: [ main ]
-
-jobs:
-  securesdlc-umbrella:
-    permissions:
-      contents: read # for actions/checkout to fetch code
-      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status  
-    uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@release-stable
-    secrets:
-      SEMGREP_APP_URL: ${{ secrets.SEMGREP_APP_URL }}
-      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
-      SDLC_SLACK_NOTIFICATIONS: ${{ secrets.SDLC_SLACK_NOTIFICATIONS }}
+name: Nautilus SecureSDLC Reusable
+run-name: "[Nautilus SecureSDLC Reusable] Ref:${{ github.ref_name }} Event:${{ github.event_name }}"
+
+on:
+  workflow_dispatch: {}
+  workflow_call: {}
+  push:
+    branches: [ main ]
+
+jobs:
+  securesdlc-umbrella:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status  
+    uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@d61b052e36d795bf5ed9eeb116b4851cc0bbdcdd
+    secrets:
+      SEMGREP_APP_URL: ${{ secrets.SEMGREP_APP_URL }}
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+      SDLC_SLACK_NOTIFICATIONS: ${{ secrets.SDLC_SLACK_NOTIFICATIONS }}