Generate Production-Hardened Docker Compose Stacks with Auto-HTTPS, Healthchecks & Backups
Default `docker-compose.yml` examples on GitHub often expose database ports to the public internet, hardcode secrets and lack log rotation. Use AI to harden any stack with isolated networks, healthchecks, Caddy auto-HTTPS and automated volume backups.
Publishing ports like `5432:5432` in Docker silently bypasses Linux UFW firewalls, exposing databases to bots within minutes. Hardening Compose files upfront prevents data loss, full disks and security breaches.
Step-by-Step Action Checklist
0 / 4 CompletedAct as a Senior DevSecOps Engineer. I want to deploy the following self-hosted stack on a [2-vCPU / 4GB RAM Linux VPS]: [Paste raw docker-compose.yml or list of services] Harden and rewrite this into a **Production-Ready Docker Compose Stack** including: 1) [Hardened `docker-compose.yml` & `.env.example`]: Pin image versions, isolate DBs on an internal network, bind host ports to `127.0.0.1`, add `healthcheck` with `service_healthy`, set memory limits, and configure JSON log rotation (`max-size: 20m`, `max-file: 3`); 2) [Caddy Reverse Proxy]: A 5-line `Caddyfile` for automatic HTTPS and security headers; 3) [Automated Nightly Backup Sidecar]: Safe database dump + volume archive with 14-day retention.