feat: harden auth and stream uploads

docker/.env.production.example

@@ -26,6 +26,13 @@ DATABASE_MAX_CONNECTIONS=10
 WORKER_CONCURRENCY=2
 IMAGE_PROCESSING_CONCURRENCY=2
 
+# Resource ceilings tuned for an 8-core / 16 GB application host.
+POSTGRES_MEMORY_LIMIT=2g
+REDIS_MEMORY_LIMIT=1g
+REDIS_MAXMEMORY=768mb
+API_MEMORY_LIMIT=3g
+WORKER_MEMORY_LIMIT=8g
+
 ALLOW_ANONYMOUS_UPLOAD=true
 ANON_MAX_FILE_SIZE_MB=5
 ANON_MAX_FILES_PER_BATCH=5

docker/docker-compose.prod.yml

@@ -25,6 +25,8 @@ x-imageforge-environment: &imageforge-environment
 services:
   postgres:
     image: postgres:16-alpine
+    mem_limit: ${POSTGRES_MEMORY_LIMIT:-2g}
+    pids_limit: 256
     environment:
       POSTGRES_DB: imageforge
       POSTGRES_USER: imageforge
@@ -40,7 +42,9 @@ services:
 
   redis:
     image: redis:7-alpine
-    command: ["redis-server", "--appendonly", "yes", "--maxmemory-policy", "noeviction"]
+    mem_limit: ${REDIS_MEMORY_LIMIT:-1g}
+    pids_limit: 128
+    command: ["redis-server", "--appendonly", "yes", "--maxmemory", "${REDIS_MAXMEMORY:-768mb}", "--maxmemory-policy", "noeviction"]
     volumes:
       - redis_data:/data
     healthcheck:
@@ -52,6 +56,8 @@ services:
 
   api:
     image: imageforge:${IMAGEFORGE_TAG:-local}
+    mem_limit: ${API_MEMORY_LIMIT:-3g}
+    pids_limit: 256
     build:
       context: ..
       dockerfile: docker/Dockerfile
@@ -102,6 +108,8 @@ services:
 
   worker:
     image: imageforge:${IMAGEFORGE_TAG:-local}
+    mem_limit: ${WORKER_MEMORY_LIMIT:-8g}
+    pids_limit: 512
     init: true
     environment:
       <<: *imageforge-environment