security: hardening по результатам аудита безопасности

deploy/docker/Dockerfile

@@ -11,7 +11,7 @@ RUN addgroup -S app && adduser -S -G app app
 COPY --from=builder --chown=app:app /out/synapse-backupper /usr/local/bin/synapse-backupper
 USER app
 EXPOSE 8080
-HEALTHCHECK --interval=30s --timeout=3s --start-period=10s CMD wget -qO- http://localhost:8080/healthz || exit 1
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s CMD ["synapse-backupper", "healthcheck"]
 LABEL maintainer="infra@tswf.io" version="0.1.0" description="Synapse PostgreSQL backup tool with composite dual-KEM encryption"
 ENTRYPOINT ["/usr/local/bin/synapse-backupper"]
 CMD ["run"]

deploy/docker/docker-compose.yml

@@ -9,6 +9,7 @@ services:
       - APP_PG_HOST=db
       - APP_PG_DATABASE=postgres
       - APP_PG_USER=synapse
+      # SECURITY: change this example password before deploying to production.
       - APP_PG_PASSWORD=changeme
       - APP_PQ_PUBLIC_KEY_PATH=/keys/synapse.pq.pub.pem
       - APP_CLASSICAL_PUBLIC_KEY_PATH=/keys/synapse.classical.pub.pem
@@ -17,7 +18,7 @@ services:
     networks:
       - my-network
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:8080/healthz"]
+      test: ["CMD", "synapse-backupper", "healthcheck"]
       interval: 30s
       timeout: 3s
       start_period: 10s