feat: Add comprehensive GitHub Actions CI/CD pipeline

GitHub Actions Workflows:
- docker-compose-validation.yml: Validates all compose files
  - Syntax validation
  - Network configuration checks
  - Traefik label validation
  - Port exposure warnings
  - Domain consistency checks
  - File naming convention enforcement

- security-checks.yml: Security scanning and validation
  - Gitleaks secret detection
  - Environment file validation
  - Placeholder password checks
  - Container image vulnerability scanning with Trivy
  - Dependency review for pull requests
  - Security report generation

- yaml-lint.yml: YAML formatting and validation
  - yamllint with custom configuration
  - File extension consistency checks
  - YAML structure validation
  - Service naming convention checks
  - Docker Compose version validation

- documentation.yml: Documentation quality checks
  - Markdown linting
  - Link validation
  - README completeness verification
  - Service documentation checks
  - Domain URL validation

- auto-label.yml: Automated PR labeling
  - Category-based labeling (core/media/services)
  - File type detection
  - Size-based labeling
  - Security-related changes detection

Configuration Files:
- .yamllint.yml: YAML linting rules for Docker Compose
- .markdownlint.json: Markdown formatting rules
- .markdown-link-check.json: Link checking configuration
- .pre-commit-config.yaml: Pre-commit hooks setup
- .github/labeler.yml: Auto-labeler configuration
- .github/CODEOWNERS: Code ownership definitions

Templates:
- pull_request_template.md: Comprehensive PR checklist
- ISSUE_TEMPLATE/bug-report.md: Bug report template
- ISSUE_TEMPLATE/service-request.md: New service request template

Documentation:
- SECURITY.md: Security policy and best practices
- CONTRIBUTING.md: Contribution guidelines

Benefits:
- Automated validation of all compose files
- Security scanning on every PR
- Consistent code formatting
- Documentation quality assurance
- Automated issue/PR management
- Pre-commit hooks for local validation
- Comprehensive security policy
- Clear contribution guidelines

2025-11-05 20:09:33 +00:00

4.3 KiB

Raw Blame History

Security Policy

Supported Versions

This is a personal homelab configuration repository. The latest commit on main is always the supported version.

Branch	Supported
main	✅
other	❌

Security Considerations

Secrets Management

DO NOT commit secrets to this repository!

All passwords in .env files should use placeholder values (e.g., changeme_*)
Real passwords should only be set in your local deployment
Use environment variables or Docker secrets for sensitive data
Never commit files containing real credentials

Container Security

All container images are scanned for vulnerabilities via GitHub Actions
HIGH and CRITICAL vulnerabilities are reported in security scans
Keep images up to date by pulling latest versions regularly
Review security scan results before deploying

Network Security

All services are behind Traefik reverse proxy
SSL/TLS is enforced via Let's Encrypt
Internal services use isolated Docker networks
SSO is enabled on most services via Tinyauth

Authentication

LLDAP provides centralized user management
Tinyauth handles SSO authentication
Services with built-in authentication are documented in README
Change all default passwords before deployment

Reporting a Vulnerability

If you discover a security vulnerability in this configuration:

DO NOT open a public issue
Contact the repository owner directly via GitHub private message
Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

What to Report

Exposed secrets or credentials
Insecure configurations
Vulnerable container images (not already detected by CI)
Authentication bypasses
Network security issues

What NOT to Report

Issues with third-party services (report to their maintainers)
Theoretical vulnerabilities without proof of concept
Social engineering attempts

Security Best Practices

Before Deployment

Change all passwords in .env files
Review all service configurations
Update container images to latest versions
Configure firewall to only allow ports 80/443
Enable automatic security updates on host OS

After Deployment

Monitor logs regularly for suspicious activity
Update services monthly (at minimum)
Backup data regularly
Review access logs
Test disaster recovery procedures

Network Hardening

Use a firewall (ufw, iptables, etc.)
Only expose ports 80 and 443 to the internet
Consider using a VPN for administrative access
Enable fail2ban or similar intrusion prevention
Use strong DNS providers with DNSSEC

Container Hardening

Run containers as non-root when possible
Use read-only filesystems where applicable
Limit container resources (CPU, memory)
Enable security options (no-new-privileges, etc.)
Regularly scan for vulnerabilities

Automated Security Scanning

This repository includes automated security scanning:

Gitleaks: Detects secrets in commits
Trivy: Scans container images for vulnerabilities
YAML Linting: Ensures proper configuration
Dependency Review: Checks for vulnerable dependencies

Review GitHub Actions results before merging PRs.

Compliance

This is a personal homelab configuration and does not claim compliance with any specific security standards. However, it follows general security best practices:

Principle of least privilege
Defense in depth
Secure by default
Regular updates and patching

External Dependencies

Security of this setup depends on:

Docker and Docker Compose security
Container image maintainers
Traefik security
LLDAP security
Host OS security

Always keep these dependencies up to date.

Disclaimer

This configuration is provided "as is" without warranty. Use at your own risk. The maintainer is not responsible for any security incidents resulting from the use of this configuration.

4.3 KiB Raw Blame History