From ad6983a49d9170a25ccda7c0a6b1a98d86d0eb90 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=BChn?= <Leon.Kuehn@seatle.intra>
Date: Thu, 10 Sep 2026 17:03:35 +0200
Subject: [PATCH] Stack: Env-Variablen vervollstaendigt (COOKIE_SECURE,
 HSTS_ENABLED, LDAP_MAX_DELETE_PCT, UPLOAD_MAX_MB)

---
 docker-compose.stack.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/docker-compose.stack.yml b/docker-compose.stack.yml
index 6baba07..607c624 100644
--- a/docker-compose.stack.yml
+++ b/docker-compose.stack.yml
@@ -28,7 +28,14 @@ services:
       - ADMIN_INIT_PASSWORD=${ADMIN_INIT_PASSWORD:-}
       # M3: Session-Secret für CSRF-Token-Ableitung (Pflicht in Produktion)
       - SESSION_SECRET=${SESSION_SECRET:-}
-      - CORS_ORIGIN=${CORS_ORIGIN:-}
+      # M1: Cookie/HSTS-Sicherheit (false für plain HTTP, true hinter TLS-Proxy)
+      - COOKIE_SECURE=${COOKIE_SECURE:-false}
+      - HSTS_ENABLED=${HSTS_ENABLED:-false}
+      # H3: Massenlösch-Schutz beim LDAP-Sync (max % löschbarer AD-User pro Sync)
+      - LDAP_MAX_DELETE_PCT=${LDAP_MAX_DELETE_PCT:-25}
+      # Upload-Größenlimit in MB
+      - UPLOAD_MAX_MB=${UPLOAD_MAX_MB:-10}
+      - CORS_ORIGIN=${CORS_ORIGIN:-http://localhost:3900}
       - NODE_ENV=${NODE_ENV:-production}
       - DATABASE_URL=postgresql://${POSTGRES_USER:-workflow}:${POSTGRES_PASSWORD:-workflow}@db:5432/${POSTGRES_DB:-workflow}
       - SESSION_MAX_PER_USER=${SESSION_MAX_PER_USER:-5}