Bach 운영 컨테이너 보안을 강화한다

백엔드는 내부 네트워크에만 두고 Docker 비밀 파일의 API 키를 프록시에서 주입한다. 프론트엔드는 루프백 포트 18102만 사용한다.

docker-compose.yml

@@ -16,28 +16,39 @@ services:
     build:
       context: ./backend
       dockerfile: Dockerfile
-    container_name: bach-backend
+    container_name: piano-bach-backend
     restart: unless-stopped
     expose:
       - "8000"
     environment:
-      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-http://localhost:5173}
-      - BACKEND_API_KEY=${BACKEND_API_KEY:-}
+      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-https://learn.itosm.co.kr,https://learn.itosm.com}
+      - BACKEND_API_KEY_FILE=/run/secrets/backend_api_key
+      - REQUIRE_AUTH=1
       - RATE_LIMIT_PER_MIN=${RATE_LIMIT_PER_MIN:-60}
       - MUSIC21_TIMEOUT_S=${MUSIC21_TIMEOUT_S:-60}
       - FINGERING_TIMEOUT_S=${FINGERING_TIMEOUT_S:-120}
     volumes:
       # Mount audiveris.jar from host (optional - PDF import is disabled if absent)
       - ./backend/bin:/app/bin:ro
+    secrets:
+      - backend_api_key
 
   frontend:
     build:
       # Root context so the Dockerfile can read pnpm-workspace.yaml + shared/
       context: .
       dockerfile: frontend/Dockerfile
-    container_name: bach-frontend
+    container_name: piano-bach-frontend
     restart: unless-stopped
     ports:
-      - "5173:80"
+      - "127.0.0.1:18102:80"
     depends_on:
       - backend
+    environment:
+      - BACKEND_API_KEY_FILE=/run/secrets/backend_api_key
+    secrets:
+      - backend_api_key
+
+secrets:
+  backend_api_key:
+    file: ./secrets/backend_api_key