turvalisus: saladused -> .env (postgres/mariadb/jupyter/n8n); n8n/playwright/jupyter -> loopback+Tailscale

main/docker-compose.yml

@@ -30,7 +30,7 @@ services:
       - "100.87.1.24:5432:5432"
     environment:
       POSTGRES_USER: ai_user
-      POSTGRES_PASSWORD: ai_secure_pass_2026
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
       POSTGRES_DB: research_db
       POSTGRES_INITDB_ARGS: "-c shared_buffers=256MB -c max_connections=200"
       PGDATA: /var/lib/postgresql/data/pgdata
@@ -59,10 +59,10 @@ services:
       - "127.0.0.1:3306:3306"
       - "100.87.1.24:3306:3306"
     environment:
-      MYSQL_ROOT_PASSWORD: ai_root_pass_2026
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
       MYSQL_DATABASE: research_mariadb
       MYSQL_USER: ai_mariadb_user
-      MYSQL_PASSWORD: ai_mariadb_pass_2026
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
       TZ: Europe/Tallinn
       LANG: C.UTF-8
     mem_limit: 4g
@@ -139,11 +139,13 @@ services:
     container_name: jupyter
     restart: always
     ports:
-      - "8887:8888"
+      # [2026-09-26] ainult loopback + Tailscale (LAN-ile mitte avatud)
+      - "127.0.0.1:8887:8888"
+      - "100.87.1.24:8887:8888"
     environment:
       - TZ=Europe/Tallinn
       - JUPYTER_ENABLE_LAB=yes
-      - JUPYTER_TOKEN=ai_server_2026
+      - JUPYTER_TOKEN=${JUPYTER_TOKEN}
       - LANG=C.UTF-8
       #- TZ=Europe/Tallinn
     volumes:

third/n8n/docker-compose.yml

@@ -5,7 +5,7 @@ services:
     container_name: ts-n8n
     environment:
       - TZ=Europe/Tallinn
-      - TS_AUTHKEY=tskey-auth-kS1DGBXc3H11CNTRL-UuCbbRQBEBBvrQhXreS7BBVwmztVyNSz
+      - TS_AUTHKEY=${TS_AUTHKEY}
       - "TS_EXTRA_ARGS=--advertise-tags=tag:container --reset"
       - TS_SERVE_CONFIG=/config/n8n.json
       - TS_STATE_DIR=/var/lib/tailscale
@@ -31,17 +31,19 @@ services:
     networks:
       - ai_network
     ports:
-      - "5678:5678"
+      # [2026-09-26] ainult loopback + Tailscale (LAN-ile mitte avatud)
+      - "127.0.0.1:5678:5678"
+      - "100.87.1.24:5678:5678"
     environment:
       TZ: Europe/Tallinn
       GENERIC_TIMEZONE: "Europe/Tallinn"
       N8N_PORT: "5678"
       N8N_PROTOCOL: "http"
       WEBHOOK_URL: "https://openwebui.odamus.com/"
-      N8N_ENCRYPTION_KEY: "d0d68562bfdc68746dab3c4041cda61e96507be3908872ffed3c1a16cb8c47a0"
+      N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
       N8N_SECURE_COOKIE: "false"
       N8N_RUNNERS_MODE: "external"
-      N8N_RUNNERS_AUTH_TOKEN: "super_strong_random_token_change_this_2026"
+      N8N_RUNNERS_AUTH_TOKEN: ${N8N_RUNNERS_AUTH_TOKEN}
       N8N_RUNNERS_BROKER_LISTEN_ADDRESS: "0.0.0.0"
       N8N_RUNNERS_TASK_TIMEOUT: "300"
       N8N_RUNNERS_JS_PACKAGES: "playwright"
@@ -61,7 +63,7 @@ services:
     environment:
       - TZ=Europe/Tallinn
       - N8N_RUNNERS_TASK_BROKER_URI=http://n8n:5679
-      - N8N_RUNNERS_AUTH_TOKEN=super_strong_random_token_change_this_2026
+      - N8N_RUNNERS_AUTH_TOKEN=${N8N_RUNNERS_AUTH_TOKEN}
       - N8N_RUNNERS_TASK_TIMEOUT=300
       - NODE_FUNCTION_ALLOW_BUILTIN=*
       - NODE_FUNCTION_ALLOW_EXTERNAL=ws
@@ -93,7 +95,9 @@ services:
       - /etc/localtime:/etc/localtime:ro
       - /usr/share/zoneinfo:/usr/share/zoneinfo:ro
     ports:
-      - "3003:3003"
+      # [2026-09-26] ainult loopback + Tailscale (LAN-ile mitte avatud)
+      - "127.0.0.1:3003:3003"
+      - "100.87.1.24:3003:3003"
     command: >
       bash -c "
         echo 'Installing dependencies...' &&