加固部署配置与敏感路径拦截

.dockerignore

@@ -0,0 +1,22 @@
+.git
+.gitignore
+.worktrees
+.agents
+.claude
+.DS_Store
+.env
+.env.*
+**/.env
+**/.env.*
+pg_data
+tmp
+.install-logs
+.pytest_cache
+**/.pytest_cache
+**/__pycache__
+**/*.pyc
+frontend/node_modules
+frontend/dist
+backend/.coverage
+backend/.pytest_cache
+nginx/certs

docker-compose.yaml

@@ -10,8 +10,6 @@ services:
     volumes:
       # 持久化数据到 Linux 本地，防止重启丢失
       - ./pg_data:/var/lib/postgresql/data
-    ports:
-      - "5432:5432"
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ctms_user -d ctms_db"]
       interval: 5s
@@ -26,8 +24,6 @@ services:
       dockerfile: Dockerfile
     container_name: ctms_backend
     restart: always
-    ports:
-      - "8000:8000"
     environment:
       DATABASE_URL: postgresql+asyncpg://ctms_user:secret_password@db/ctms_db
     depends_on:

nginx/nginx.conf

@@ -42,6 +42,12 @@ http {
             add_header Cache-Control "public, max-age=86400" always;
         }
 
+        location ~* (^|/)(\.git|\.env($|[./_-])|wp-config\.php|config\.php|database\.yml|backup($|[._/-])) {
+            access_log off;
+            log_not_found off;
+            return 404;
+        }
+
         location /api/ {
             proxy_pass http://backend;
             proxy_set_header Host $host;