feat: increased security

docker-compose.yml

@@ -12,6 +12,17 @@ services:
       - LETSENCRYPT_HOST=${LETSENCRYPT_HOST}
       - LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL}
     restart: unless-stopped
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+          cpus: '0.50'
+    tmpfs:
+      - /tmp
+      - /app/.next/cache
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://localhost:80/"]
       interval: 30s
@@ -21,4 +32,4 @@ services:
 
 networks:
   proxy:
-    external: true
+    external: true