Harden immutable release deployment

deploy/unraid/run-dockerman-container.sh

@@ -12,12 +12,13 @@ if [ -f .env ]; then
 fi
 
 GEOINTEL_FRONTEND_PORT="${GEOINTEL_FRONTEND_PORT:-1202}"
+GEOINTEL_IMAGE="${GEOINTEL_IMAGE:-geointel-all-in-one:latest}"
 GEOINTEL_STORAGE_PATH="${GEOINTEL_STORAGE_PATH:-/mnt/user/appdata/geointel/storage}"
 GEOINTEL_MODELS_PATH="${GEOINTEL_MODELS_PATH:-/mnt/user/appdata/geointel/models}"
 GEOINTEL_POSTGIS_DATA_PATH="${GEOINTEL_POSTGIS_DATA_PATH:-/mnt/user/appdata/geointel/postgres-data}"
 GEOINTEL_POSTGRES_DB="${GEOINTEL_POSTGRES_DB:-geointel}"
 GEOINTEL_POSTGRES_USER="${GEOINTEL_POSTGRES_USER:-geointel}"
-GEOINTEL_POSTGRES_PASSWORD="${GEOINTEL_POSTGRES_PASSWORD:-geointel}"
+GEOINTEL_POSTGRES_PASSWORD="${GEOINTEL_POSTGRES_PASSWORD:-}"
 GEOINTEL_CORS_ORIGINS="${GEOINTEL_CORS_ORIGINS:-http://localhost:${GEOINTEL_FRONTEND_PORT},http://127.0.0.1:${GEOINTEL_FRONTEND_PORT},http://192.168.10.150:${GEOINTEL_FRONTEND_PORT}}"
 GEOINTEL_MAX_UPLOAD_MB="${GEOINTEL_MAX_UPLOAD_MB:-500}"
 ORTHOPHOTO_ENABLED="${ORTHOPHOTO_ENABLED:-true}"
@@ -101,6 +102,39 @@ OLLAMA_TIMEOUT_SECONDS="${OLLAMA_TIMEOUT_SECONDS:-120}"
 OLLAMA_MAX_OUTPUT_TOKENS="${OLLAMA_MAX_OUTPUT_TOKENS:-1200}"
 OLLAMA_CONTEXT_TOKENS="${OLLAMA_CONTEXT_TOKENS:-16384}"
 
+validate_runtime_config() {
+  case "$GEOINTEL_FRONTEND_PORT" in
+    ''|*[!0-9]*)
+      echo "GEOINTEL_FRONTEND_PORT must be a whole number." >&2
+      return 2
+      ;;
+  esac
+  if [ "$GEOINTEL_FRONTEND_PORT" -lt 1 ] || [ "$GEOINTEL_FRONTEND_PORT" -gt 65535 ]; then
+    echo "GEOINTEL_FRONTEND_PORT must be between 1 and 65535." >&2
+    return 2
+  fi
+
+  case "$GEOINTEL_MAX_UPLOAD_MB" in
+    ''|*[!0-9]*)
+      echo "GEOINTEL_MAX_UPLOAD_MB must be a whole number." >&2
+      return 2
+      ;;
+  esac
+  if [ "$GEOINTEL_MAX_UPLOAD_MB" -lt 1 ] || [ "$GEOINTEL_MAX_UPLOAD_MB" -gt 2048 ]; then
+    echo "GEOINTEL_MAX_UPLOAD_MB must be between 1 and 2048." >&2
+    return 2
+  fi
+
+  case "$GEOINTEL_POSTGRES_PASSWORD" in
+    ''|geointel|postgres|password|changeme|change-me-before-shared-use)
+      echo "Refusing deployment with an empty or known-default PostGIS password." >&2
+      return 2
+      ;;
+  esac
+
+  docker image inspect "$GEOINTEL_IMAGE" >/dev/null
+}
+
 install_dockerman_metadata() {
   if [ -d /boot/config/plugins/dockerMan ]; then
     mkdir -p /boot/config/plugins/dockerMan/templates-user /boot/config/plugins/dockerMan/images
@@ -125,6 +159,7 @@ migrate_compose_volume_if_needed() {
   cp -a "${compose_volume_path}/." "$GEOINTEL_POSTGIS_DATA_PATH/"
 }
 
+validate_runtime_config
 install_dockerman_metadata
 
 docker compose down --remove-orphans || true
@@ -233,6 +268,6 @@ docker run -d \
   -v "${GEOINTEL_POSTGIS_DATA_PATH}:/var/lib/postgresql/data" \
   -v "${GEOINTEL_STORAGE_PATH}:/app/storage" \
   -v "${GEOINTEL_MODELS_PATH}:/app/models" \
-  geointel-all-in-one:latest
+  "$GEOINTEL_IMAGE"
 
 docker ps --filter name=geointel