feat: marketplace modules and isolated container management

docker-compose.yml

@@ -37,16 +37,43 @@ services:
       PORT: ${PORT:-3000}
       DATABASE_URL: ${DATABASE_URL:?Bitte DATABASE_URL in .env setzen}
       SESSION_TTL_MINUTES: ${SESSION_TTL_MINUTES:-120}
-      COOKIE_SECURE: ${COOKIE_SECURE:-false}
+      COOKIE_SECURE: ${COOKIE_SECURE:-true}
       BEHIND_PROXY: "true"
+      MODULE_UID_BASE: ${MODULE_UID_BASE:-20000}
+      MODULE_DOCKER_HOST: unix:///var/run/docker.sock
+      MPM_CONTAINER_NAME: mpm-platform
+      DOCKER_SOCKET_GID: ${DOCKER_SOCKET_GID:-0}
       MODULES_DIR: /app/data/modules
       LOGS_DIR: /app/data/logs
       ADMIN_USERNAME: ${ADMIN_USERNAME:?Bitte ADMIN_USERNAME in .env setzen}
       ADMIN_EMAIL: ${ADMIN_EMAIL:?Bitte ADMIN_EMAIL in .env setzen}
       ADMIN_PASSWORD: ${ADMIN_PASSWORD:?Bitte ADMIN_PASSWORD in .env setzen}
+      MARKETPLACE_PUBLIC_URL: ${MARKETPLACE_PUBLIC_URL:-http://127.0.0.1:${APP_PORT:-8080}}
+      MARKETPLACE_TOKEN_ENCRYPTION_KEY: ${MARKETPLACE_TOKEN_ENCRYPTION_KEY:-}
+      GITHUB_OAUTH_CLIENT_ID: ${GITHUB_OAUTH_CLIENT_ID:-}
+      GITHUB_OAUTH_CLIENT_SECRET: ${GITHUB_OAUTH_CLIENT_SECRET:-}
+      GITEA_BASE_URL: ${GITEA_BASE_URL:-}
+      GITEA_OAUTH_CLIENT_ID: ${GITEA_OAUTH_CLIENT_ID:-}
+      GITEA_OAUTH_CLIENT_SECRET: ${GITEA_OAUTH_CLIENT_SECRET:-}
+      FORGEJO_BASE_URL: ${FORGEJO_BASE_URL:-}
+      FORGEJO_OAUTH_CLIENT_ID: ${FORGEJO_OAUTH_CLIENT_ID:-}
+      FORGEJO_OAUTH_CLIENT_SECRET: ${FORGEJO_OAUTH_CLIENT_SECRET:-}
     ports:
-      - "${APP_PORT:-8080}:8080"
+      - "127.0.0.1:${APP_PORT:-8080}:8080"
+    cap_drop:
+      - ALL
+    cap_add:
+      - SETUID
+      - SETGID
+      - KILL
+    security_opt:
+      - no-new-privileges:true
+    group_add:
+      - "${DOCKER_SOCKET_GID:-0}"
     volumes:
+      # Needed by the backend to manage isolated per-module Compose stacks.
+      # Module containers never receive this socket.
+      - /var/run/docker.sock:/var/run/docker.sock
       # Modul-Installationen und Logs persistent halten (Container-Updates überleben)
       - modules-data:/app/data/modules
       - module-logs:/app/data/logs
@@ -54,4 +81,4 @@ services:
 volumes:
   postgres-data:
   modules-data:
-  module-logs:
+  module-logs: