build: harden controller v2 runtime

docker-compose.yml

@@ -1,22 +1,61 @@
 services:
   controller:
-    build: .
+    build:
+      context: .
+      args:
+        CONTROLLER_UID: ${CONTROLLER_UID:-1000}
+        CONTROLLER_GID: ${CONTROLLER_GID:-1000}
+    image: video-player-controller:local
     container_name: yt-controller
     restart: unless-stopped
+    init: true
+    read_only: true
     ports:
-      - "7531:7531"
+      - "${CONTROLLER_WEB_PORT:-7531}:7531"
     environment:
-      - FLASK_SECRET_KEY=change-me
-      - MQTT_HOST=10.40.0.2
-      - MQTT_PORT=1883
+      FLASK_SECRET_KEY: ${FLASK_SECRET_KEY:?Set FLASK_SECRET_KEY in .env}
+      MQTT_HOST: ${MQTT_HOST:-10.40.0.2}
+      MQTT_PORT: ${MQTT_PORT:-1883}
+      PORT: 7531
+      YTPLAYER_DATA_BASE: /controller-data
+      YTPLAYER_MEDIA_BASE: /mnt/Media/YTPlayer
+      YTPLAYER_COOKIE_PATH: /run/secrets/yt-dlp-cookies.txt
     volumes:
-      - /mnt/Media:/mnt/Media   # same path inside container
-      - /home/media/Scripts/Video-Player:/controller-data
-      - /home/media/Scripts/Video-Player/cookies.txt:/cookies_ro.txt:ro
+      - ${CONTROLLER_DATA_DIR:?Set CONTROLLER_DATA_DIR in .env}:/controller-data
+      - ${YTPLAYER_MEDIA_DIR:-/mnt/Media/YTPlayer}:/mnt/Media/YTPlayer
+      - ./config.yaml:/app/config.yaml:ro
+      # Optional: place yt-dlp-cookies.txt in this host directory.
+      - type: bind
+        source: ${CONTROLLER_SECRETS_DIR:-./secrets}
+        target: /run/secrets
+        read_only: true
+    tmpfs:
+      - /tmp:rw,nosuid,nodev,noexec,mode=1777,size=256m
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test:
+        - CMD
+        - python
+        - -c
+        - >-
+          import urllib.request;
+          urllib.request.urlopen('http://127.0.0.1:7531/healthz', timeout=3).read()
+      interval: 30s
+      timeout: 5s
+      start_period: 30s
+      retries: 3
+    stop_grace_period: 45s
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: "3"
     networks:
       - tabernet
 
-
 networks:
   tabernet:
-    external: true
+    external: true