Harden Docker container configurations

- Gitea: Bind ports to localhost, add security options, resource limits, health checks
- Jellyfin: Add security options, enhanced resource limits, health checks (kept host networking for GPU)
- qBittorrent: Bind torrent ports to localhost, add security options, health checks
- All configs: Non-root users, capability drops, no-new-privileges, tmpfs hardening

Security improvements:
- Ports no longer exposed to all interfaces (0.0.0.0)
- Added security options (no-new-privileges, cap_drop)
- Resource limits and health checks implemented
- Read-only filesystems where possible
- Temporary filesystems with restrictions

config/docker/jellyfin/docker-compose.yml

@@ -2,6 +2,13 @@
 # Deploy with: sudo mkdir -p /opt/docker/jellyfin && sudo cp config/docker/jellyfin/docker-compose.yml /opt/docker/jellyfin/
 # Start with: cd /opt/docker/jellyfin && sudo docker-compose up -d
 
+# HARDENED CONFIGURATION - Updated for security
+# - Non-root user maintained (1000:1000)
+# - Security options added
+# - Resource limits enhanced
+# - Health check added
+# - Network mode kept for hardware acceleration (acceptable risk)
+
 services:
   jellyfin:
     image: jellyfin/jellyfin:latest
@@ -16,8 +23,24 @@ services:
       - JELLYFIN_PublishedServerUrl=https://ak-homelab.duckdns.org/media
 
     # Network mode for better performance and hardware acceleration
+    # NOTE: Host networking is required for GPU hardware acceleration
+    # This is an acceptable security trade-off for media performance
     network_mode: host
 
+    # Security hardening
+    read_only: false  # Jellyfin needs write access for transcoding
+    tmpfs:
+      - /tmp:noexec,nosuid,size=2G
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - SETUID
+      - SETGID
+      - DAC_OVERRIDE
+    security_opt:
+      - no-new-privileges:true
+
     # Volume mounts - using same folders as Copyparty
     volumes:
       # Jellyfin configuration and data
@@ -39,15 +62,20 @@ services:
     devices:
       - /dev/dri:/dev/dri
 
-    # Memory limits for container stability
+    # Enhanced resource limits
     deploy:
       resources:
         limits:
+          cpus: '2.0'
           memory: 2G
         reservations:
+          cpus: '0.5'
           memory: 512M
 
-# Optional: Create a custom network if not using host networking
-# networks:
-#   jellyfin:
-#     driver: bridge
+    # Health check
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8096/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s