fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the
audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with
base schema, stateful service stability, safer Dockerfiles/git builds, and
platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off).

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-app/templates/_helpers.tpl

@@ -46,6 +46,16 @@ Database deployment name
 {{- printf "%s-db" .Values.app.name }}
 {{- end }}
 
+{{/*
+Optional mirror registry prefix for Docker Hub images.
+Usage: {{ include "cloudhost-app.baseImage" (dict "root" $ "image" "redis:7.2-alpine") }}
+*/}}
+{{- define "cloudhost-app.baseImage" -}}
+{{- $reg := "" -}}
+{{- with .root.Values.images -}}{{- $reg = .baseRegistry | default "" -}}{{- end -}}
+{{- if $reg -}}{{ printf "%s/%s" $reg .image }}{{- else -}}{{ .image }}{{- end -}}
+{{- end }}
+
 {{/*
 Database image — auto-computed from type + version if not explicitly set
 */}}
@@ -53,13 +63,13 @@ Database image — auto-computed from type + version if not explicitly set
 {{- if .Values.database.image }}
   {{- .Values.database.image }}
 {{- else if eq .Values.database.type "postgresql" }}
-  {{- printf "postgres:%s-alpine" .Values.database.version }}
+  {{- include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "postgres:%s-alpine" .Values.database.version)) }}
 {{- else if eq .Values.database.type "mariadb" }}
-  {{- printf "mariadb:%s" .Values.database.version }}
+  {{- include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "mariadb:%s" .Values.database.version)) }}
 {{- else if eq .Values.database.type "mongodb" }}
-  {{- printf "mongo:%s" .Values.database.version }}
+  {{- include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "mongo:%s" .Values.database.version)) }}
 {{- else }}
-  {{- printf "mysql:%s" .Values.database.version }}
+  {{- include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "mysql:%s" .Values.database.version)) }}
 {{- end }}
 {{- end }}
 

backend/helm/cloudhost-app/templates/_log-shipper.tpl

@@ -5,7 +5,7 @@
 {{- define "cloudhost-app.logShipperContainers" -}}
 {{- if .root.Values.elasticsearch.enabled }}
 - name: log-shipper
-  image: fluent/fluent-bit:2.2
+  image: {{ include "cloudhost-app.baseImage" (dict "root" .root "image" "fluent/fluent-bit:2.2") }}
   resources:
     requests:
       cpu: "10m"

backend/helm/cloudhost-app/templates/db-deployment.yaml

@@ -16,6 +16,10 @@ metadata:
     {{- include "cloudhost-app.labels" . | nindent 4 }}
 spec:
   replicas: 1
+  # RWO volume + single replica: recreate the old pod before starting the new
+  # one — a rolling update would deadlock on the attached PVC.
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: {{ $dbName }}
@@ -114,7 +118,7 @@ spec:
               command: ["healthcheck.sh", "--connect", "--innodb_initialized"]
             {{- else if eq .Values.database.type "mongodb" }}
             exec:
-              command: ["mongosh", "--eval", "db.adminCommand('ping')"]
+              command: ["sh", "-c", "mongosh --quiet -u \"$MONGO_INITDB_ROOT_USERNAME\" -p \"$MONGO_INITDB_ROOT_PASSWORD\" --eval \"db.adminCommand('ping')\""]
             {{- else }}
             exec:
               command: ["mysqladmin", "ping", "-h", "127.0.0.1"]
@@ -131,7 +135,7 @@ spec:
               command: ["healthcheck.sh", "--connect", "--innodb_initialized"]
             {{- else if eq .Values.database.type "mongodb" }}
             exec:
-              command: ["mongosh", "--eval", "db.adminCommand('ping')"]
+              command: ["sh", "-c", "mongosh --quiet -u \"$MONGO_INITDB_ROOT_USERNAME\" -p \"$MONGO_INITDB_ROOT_PASSWORD\" --eval \"db.adminCommand('ping')\""]
             {{- else }}
             exec:
               command: ["mysqladmin", "ping", "-h", "127.0.0.1"]

backend/helm/cloudhost-app/templates/deployment.yaml

@@ -217,7 +217,7 @@ spec:
             {{- end }}
         {{- if .Values.elasticsearch.enabled }}
         - name: fluent-bit
-          image: fluent/fluent-bit:2.2
+          image: {{ include "cloudhost-app.baseImage" (dict "root" $ "image" "fluent/fluent-bit:2.2") }}
           resources:
             requests:
               cpu: "10m"

backend/helm/cloudhost-app/templates/elasticsearch-credentials-secret.yaml

@@ -1,4 +1,7 @@
 {{- if .Values.elasticsearch.enabled }}
+{{- if not .Values.elasticsearch.fluentbitPassword }}
+{{- fail "elasticsearch.fluentbitPassword is required when elasticsearch.enabled=true — no hardcoded default is shipped" }}
+{{- end }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -8,7 +11,7 @@ metadata:
     {{- include "cloudhost-app.labels" . | nindent 4 }}
 type: Opaque
 stringData:
-  ELASTIC_PASSWORD: {{ .Values.elasticsearch.elasticPassword | default "CloudHost2024!Secure" | quote }}
-  FLUENTBIT_PASSWORD: {{ .Values.elasticsearch.fluentbitPassword | default "FluentBit2024!Writer" | quote }}
-  KIBANA_SYSTEM_PASSWORD: {{ .Values.elasticsearch.kibanaPassword | default "Kibana2024!System" | quote }}
+  ELASTIC_PASSWORD: {{ .Values.elasticsearch.elasticPassword | quote }}
+  FLUENTBIT_PASSWORD: {{ .Values.elasticsearch.fluentbitPassword | quote }}
+  KIBANA_SYSTEM_PASSWORD: {{ .Values.elasticsearch.kibanaPassword | quote }}
 {{- end }}

backend/helm/cloudhost-app/templates/rabbitmq-deployment.yaml

@@ -2,11 +2,22 @@
 {{- $name       := include "cloudhost-app.name" . -}}
 {{- $ns         := include "cloudhost-app.namespace" . -}}
 {{- $rabbitName := printf "%s-rabbitmq" $name -}}
+{{- /* Preserve the existing password across upgrades — RabbitMQ only applies
+       RABBITMQ_DEFAULT_PASS on first boot, so a regenerated secret would
+       diverge from the credentials stored in the persisted volume. */ -}}
+{{- $rabbitSecretName := printf "%s-secret" $rabbitName -}}
+{{- $existingRabbit := lookup "v1" "Secret" $ns $rabbitSecretName -}}
+{{- $rabbitPass := "" -}}
+{{- if and $existingRabbit $existingRabbit.data (index $existingRabbit.data "password") -}}
+{{- $rabbitPass = index $existingRabbit.data "password" | b64dec -}}
+{{- else -}}
+{{- $rabbitPass = randAlphaNum 16 -}}
+{{- end -}}
 ---
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ $rabbitName }}-secret
+  name: {{ $rabbitSecretName }}
   namespace: {{ $ns }}
   labels:
     app: {{ $rabbitName }}
@@ -16,7 +27,7 @@ metadata:
 type: Opaque
 data:
   username: {{ "appuser" | b64enc | quote }}
-  password: {{ randAlphaNum 16 | b64enc | quote }}
+  password: {{ $rabbitPass | b64enc | quote }}
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -48,6 +59,9 @@ metadata:
     {{- include "cloudhost-app.labels" . | nindent 4 }}
 spec:
   replicas: 1
+  # RWO volume + single replica: recreate instead of rolling update.
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: {{ $rabbitName }}
@@ -58,7 +72,7 @@ spec:
     spec:
       containers:
         - name: rabbitmq
-          image: {{ printf "rabbitmq:%s-management-alpine" (.Values.rabbitmq.version | default "3.13") }}
+          image: {{ include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "rabbitmq:%s-management-alpine" (.Values.rabbitmq.version | default "3.13"))) }}
           ports:
             - containerPort: 5672
               name: amqp
@@ -68,12 +82,12 @@ spec:
             - name: RABBITMQ_DEFAULT_USER
               valueFrom:
                 secretKeyRef:
-                  name: {{ $rabbitName }}-secret
+                  name: {{ $rabbitSecretName }}
                   key: username
             - name: RABBITMQ_DEFAULT_PASS
               valueFrom:
                 secretKeyRef:
-                  name: {{ $rabbitName }}-secret
+                  name: {{ $rabbitSecretName }}
                   key: password
           volumeMounts:
             - name: rabbitmq-data

backend/helm/cloudhost-app/templates/redis-deployment.yaml

@@ -2,11 +2,21 @@
 {{- $name    := include "cloudhost-app.name" . -}}
 {{- $ns      := include "cloudhost-app.namespace" . -}}
 {{- $redisName := printf "%s-redis" $name -}}
+{{- /* Preserve the existing password across upgrades — regenerating it every
+       upgrade would break app↔Redis auth against the persisted volume. */ -}}
+{{- $redisSecretName := printf "%s-secret" $redisName -}}
+{{- $existingRedis := lookup "v1" "Secret" $ns $redisSecretName -}}
+{{- $redisPass := "" -}}
+{{- if and $existingRedis $existingRedis.data (index $existingRedis.data "password") -}}
+{{- $redisPass = index $existingRedis.data "password" | b64dec -}}
+{{- else -}}
+{{- $redisPass = randAlphaNum 16 -}}
+{{- end -}}
 ---
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ $redisName }}-secret
+  name: {{ $redisSecretName }}
   namespace: {{ $ns }}
   labels:
     app: {{ $redisName }}
@@ -15,7 +25,7 @@ metadata:
     "helm.sh/resource-policy": keep
 type: Opaque
 data:
-  password: {{ randAlphaNum 16 | b64enc | quote }}
+  password: {{ $redisPass | b64enc | quote }}
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -47,6 +57,10 @@ metadata:
     {{- include "cloudhost-app.labels" . | nindent 4 }}
 spec:
   replicas: 1
+  # RWO volume + single replica: recreate the old pod before starting the new
+  # one, otherwise a rolling update deadlocks on the attached PVC.
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: {{ $redisName }}
@@ -57,7 +71,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: {{ printf "redis:%s-alpine" (.Values.redis.version | default "7.2") }}
+          image: {{ include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "redis:%s-alpine" (.Values.redis.version | default "7.2"))) }}
           args: ["--requirepass", "$(REDIS_PASSWORD)"]
           ports:
             - containerPort: 6379
@@ -65,7 +79,14 @@ spec:
             - name: REDIS_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ $redisName }}-secret
+                  name: {{ $redisSecretName }}
+                  key: password
+            # redis-cli in the probes auto-authenticates from REDISCLI_AUTH,
+            # so `redis-cli ping` works even with --requirepass set.
+            - name: REDISCLI_AUTH
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $redisSecretName }}
                   key: password
           volumeMounts:
             - name: redis-data