chore: harden public release baseline

- Fix traceback leak: remove 'or True' in error handler (app.py)
- Remove internal hostnames ALPHA-01 and Shinra-Gate from all files
- Remove debug print leaking secret bytes in archive auth
- Replace known hardcoded fallback secrets with neutral placeholders
- Add MIT LICENSE (Copyright 2026 crybe)
- Harden .gitignore with key/cert/archive/secret patterns
- Expand SECURITY.md with Docker socket and public exposure warnings
- Update README clone URL and add public internet warning

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: crybe

.gitignore

@@ -29,20 +29,44 @@ logs/
 
 # Environment & Secrets
 .env
+.env.*
+!.env.example
 .env.local
 .env.development.local
 .env.test.local
 .env.production.local
 *.bak
 *.old
 *.orig
+*.key
+*.pem
+*.crt
+*.p12
+*.pfx
+*secret*
+*token*
+*credentials*
+
+# Archives & Dumps
+*.dump
+*.tar
+*.tar.gz
+*.zip
+*.7z
+*.sqlite3
 
 # Node / Frontend
 node_modules/
 dist/
 build/
 .eslintcache
 .stylelintcache
+.cache/
+
+# Virtual environments
+.venv/
+venv/
+instance/
 
 # IDEs
 .idea/

Abschluss-Dashboard.md

@@ -8,8 +8,6 @@
 ## 🛰️ MISSION OVERVIEW
 Das Ziel der Operation war das **Readability Hardening** des zentralen Antigravity Dashboards. Fokus lag auf der Eliminierung von Lesbarkeitsschwächen in transparenten Panels und der Schärfung der visuellen Hierarchie für kritische Telemetriedaten. Die folgenden Aufnahmen zeigen den **echten Live-Stand** nach dem Deployment.
 
-![Live Dashboard Header](file:///home/user/.gemini/antigravity/brain/2c1b9eed-1d6d-4088-bcce-3d7f5b5a04f1/growbox_header_metrics_1778366855972.png)
-
 ---
 
 ## 🛠️ CORE MODIFICATIONS (TECHNICAL SPECS)
@@ -24,25 +22,21 @@ Ein systemweiter Font-Bump wurde durchgeführt, um die Informationsdichte bei gl
 - **Labels:** Erhöht auf `11px/12px` (Font-Weight: Black).
 - **Tracking:** Erhöht auf `0.2em` bis `0.4em` für optimale Lesbarkeit in Fenstermodi.
 
-![Bloom & Environment Progress](file:///home/user/.gemini/antigravity/brain/2c1b9eed-1d6d-4088-bcce-3d7f5b5a04f1/bloom_environment_progress_1778366893604.png)
-
 ### 3. Log Module Refactor // System_Module
 Das "Grow Logbuch" wurde optisch gehärtet und als festes Systemmodul integriert.
 - **Design:** Taktische Rahmen mit `CornerBrackets` und `mascot-ornament`.
 - **Status:** Klare Anzeige von Systemzuständen (z.B. `DATABASE_EMPTY`).
 
-![Grow Log Module](file:///home/user/.gemini/antigravity/brain/2c1b9eed-1d6d-4088-bcce-3d7f5b5a04f1/grow_log_module_1778366923227.png)
-
 ---
 
 ## 🔍 DEPLOYMENT & VERIFICATION
-Das Update wurde erfolgreich auf den Live-Server (`ALPHA-01`) synchronisiert und verifiziert.
+Das Update wurde erfolgreich auf den Live-Server synchronisiert und verifiziert.
 
 | Metrik | Wert | Status |
 | :--- | :--- | :--- |
 | **Version** | v2.5.5 | `🟢 ACTIVE` |
-| **Node** | ALPHA-01 (Shinra-Gate) | `🟢 ONLINE` |
-| **Health-Check** | DB: Connected / Disk: 561GB | `🟢 STABLE` |
+| **Node** | homelab-server | `🟢 ONLINE` |
+| **Health-Check** | DB: Connected / Disk: sufficient free space | `🟢 STABLE` |
 
 ---
 

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 crybe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -33,8 +33,8 @@ Das (Nexus Command Hub) dient als zentrale Kommandozentrale für technik-affine
 
 ### 1. Repository klonen
 ```bash
-git clone https://github.com/your-username/project-dashboard.git
-cd project-dashboard
+git clone https://github.com/crybe/ProjectOperationCenter.git
+cd ProjectOperationCenter
 ```
 
 ### 2. Konfiguration
@@ -66,8 +66,13 @@ Das Dashboard ist anschließend unter `http://localhost:5666` erreichbar.
 ---
 
 ## 🛡️ Sicherheitshinweis
+
+> **Do not expose this dashboard directly to the public internet.**
+
 Dieses Projekt ist für den Einsatz im privaten Netzwerk konzipiert. Stellen Sie sicher, dass der Zugang von außen nur über gesicherte Tunnel (VPN) oder einen authentifizierten Reverse-Proxy erfolgt.
 
+**`docker-compose.yml` is intended for local/private homelab use only.** Bind-Ports sind standardmäßig auf `127.0.0.1` beschränkt und sollten nicht öffentlich erreichbar sein.
+
 **WICHTIG:** Committen Sie niemals Ihre `.env` Datei mit echten Zugangsdaten!
 
 ---

SECURITY.md

@@ -12,6 +12,15 @@ Please do not report security vulnerabilities through public GitHub issues. Inst
 4. **API Keys**: Ensure all API keys (Gemini, Groq, OpenRouter, etc.) have appropriate usage limits set in their respective provider consoles to prevent abuse.
 5. **Docker Socket**: Mounting `/var/run/docker.sock` allows the container to control the host Docker daemon. Use this feature with caution and only if you trust the network environment.
 
+6. **No Public Exposure**: Do not expose this dashboard directly to the public internet. Always use a VPN (Tailscale, WireGuard) or an authenticated reverse proxy (Nginx Proxy Manager, Traefik) in front of it.
+7. **No Secrets in Git**: Never commit API keys, passwords, session secrets, or any credentials to this repository. The `.env` file must remain local and untracked.
+8. **No Production API Keys**: Use test/sandbox keys during development. Apply rate limits and IP restrictions in your API provider consoles.
+
+## Docker Security Notes
+
+- **Docker Socket (`/var/run/docker.sock`)**: The `docker-compose.yml` may mount the Docker socket to allow container management via the UI. This grants the container full control over the host Docker daemon. Only use this feature in a trusted, isolated network environment.
+- **Root Containers**: Avoid running containers as root in production. Review the `Dockerfile` and `docker-compose.yml` before deploying in shared or sensitive environments.
+
 ## Secrets Cleanup
 
 This repository has been sanitized for public release. If you find any leaked secrets or private information in the history or code, please report it immediately.

app.py

@@ -55,10 +55,10 @@ def handle_exception(e):
 
         if request.path.startswith('/api/'):
             import traceback
-            error_details = traceback.format_exc() if app.debug or True else 'Kontaktieren Sie den Administrator'
+            error_details = traceback.format_exc() if app.debug else 'Interner Serverfehler'
             return jsonify({
-                'ok': False, 
-                'error': 'Interner Serverfehler', 
+                'ok': False,
+                'error': 'Interner Serverfehler',
                 'details': error_details
             }), 500
         return render('500.html', error=str(e)), 500

blueprints/api/__init__.py

@@ -266,8 +266,6 @@ def grow_archive():
     provided = (request.args.get('passphrase') or '').strip()
     secret   = os.environ.get('ADMIN_PASSPHRASE', LOGIN_PASSWORD).strip()
 
-    print(f"[ARCHIVE] Auth check: received={provided[:3]}***, expected={secret[:3]}***", file=sys.stderr)
-    
     if provided != secret:
         return jsonify({'ok': False, 'error': 'PASS_REQUIRED'})
 
@@ -375,7 +373,7 @@ def grow_archive_post():
     password = data.get('password', '')
 
     # Simple passphrase check
-    secret = os.environ.get('ADMIN_PASSPHRASE', 'admin-dev')
+    secret = os.environ.get('ADMIN_PASSPHRASE', '')
     if password != secret:
         return jsonify({"ok": False, "error": "Ungültige Passphrase"}), 403
 

core/config.py

@@ -1,7 +1,7 @@
 import os
 
 class Config:
-    SECRET_KEY = os.environ.get('SECRET_KEY', 'devhub-secret-2026-tactical-fallback')
+    SECRET_KEY = os.environ.get('SECRET_KEY', 'change-me-set-a-real-secret-key')
 
     # Pfad-Erkennung
     PROJ_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -38,5 +38,5 @@ class Config:
     def validate(cls):
         if not os.path.exists(cls.DATA_PATH): os.makedirs(cls.DATA_PATH, exist_ok=True)
         if not os.path.exists(cls.LOG_DIR): os.makedirs(cls.LOG_DIR, exist_ok=True)
-        if cls.SECRET_KEY == 'devhub-secret-2026-tactical-fallback':
-            print('WARNING: Using default SECRET_KEY.')
+        if cls.SECRET_KEY == 'change-me-set-a-real-secret-key':
+            print('WARNING: Using default SECRET_KEY. Set SECRET_KEY in your .env file!')

core/constants.py

@@ -51,6 +51,6 @@
 
 # Bot & Service URLs
 BOT_CTRL_URL = os.environ.get('BOT_CTRL_URL', 'http://localhost:5667')
-CTRL_TOKEN   = os.environ.get('CTRL_TOKEN',   'default-token')
+CTRL_TOKEN   = os.environ.get('CTRL_TOKEN',   '')
 PROM_URL     = os.environ.get('PROM_URL',     'http://localhost:9090/api/v1/query')
 n8n_BASE_URL = os.environ.get('N8N_BASE_URL', 'http://localhost:5678')

frontend/src/pages/Growbox.tsx

@@ -719,7 +719,7 @@ export default function Growbox() {
             <div>
               <div className="flex items-center gap-3 mb-1">
                  <div className="h-[1px] w-8 bg-emerald-600/30" />
-                 <span className="text-tactical-label opacity-40">Operational_Node: ALPHA-01</span>
+                 <span className="text-tactical-label opacity-40">Operational_Node: homelab-server</span>
               </div>
               <h2 className="text-5xl sm:text-7xl font-black text-emerald-500 tracking-tighter uppercase italic flex items-center gap-6 drop-shadow-[0_8px_24px_rgba(0,0,0,0.7)]">
                 Growth<span className="text-emerald-700">_OS</span>