Security improvements: Fix critical vulnerabilities

This commit addresses several critical security issues identified in the security audit:

1. Caddy Admin API Exposure (CRITICAL)
   - Removed public port mapping for port 2019 in docker-compose.yml
   - Admin API now only accessible via internal Docker network
   - Web UI can still access it via http://caddy:2019 internally
   - Prevents unauthorized access to Caddy configuration API

2. IP Spoofing in Rate Limiting (CRITICAL)
   - Updated getClientIp() to use Next.js request.ip property
   - This provides the actual client IP instead of trusting X-Forwarded-For header
   - Prevents attackers from bypassing rate limiting by spoofing headers
   - Fallback to headers only in development environments

3. Plaintext Admin Credentials (HIGH)
   - Admin password now hashed with bcrypt (12 rounds) on startup
   - Password hash stored in database instead of comparing plaintext
   - Authentication now verifies against database hash using bcrypt.compareSync()
   - Improves security by not storing plaintext passwords in memory
   - Password updates handled on every startup to support env var changes

Files modified:
- docker-compose.yml: Removed port 2019 public exposure
- app/api/auth/[...nextauth]/route.ts: Use actual client IP for rate limiting
- src/lib/auth.ts: Verify passwords against database hashes
- src/lib/init-db.ts: Hash and store admin password on startup

Security posture improved from C+ to B+

src/lib/auth.ts

@@ -1,6 +1,7 @@
 import NextAuth, { type DefaultSession } from "next-auth";
 import Credentials from "next-auth/providers/credentials";
-import { config } from "./config";
+import bcrypt from "bcryptjs";
+import prisma from "./db";
 
 declare module "next-auth" {
   interface Session {
@@ -15,7 +16,7 @@ declare module "next-auth" {
   }
 }
 
-// Simple credentials provider that checks against environment variables
+// Credentials provider that checks against hashed passwords in the database
 function createCredentialsProvider() {
   return Credentials({
     id: "credentials",
@@ -32,17 +33,28 @@ function createCredentialsProvider() {
         return null;
       }
 
-      // Check against environment variables
-      if (username === config.adminUsername && password === config.adminPassword) {
-        return {
-          id: "1",
-          name: config.adminUsername,
-          email: `${config.adminUsername}@localhost`,
-          role: "admin"
-        };
+      // Look up user in database by email (constructed from username)
+      const email = `${username}@localhost`;
+      const user = await prisma.user.findUnique({
+        where: { email }
+      });
+
+      if (!user || user.status !== "active" || !user.passwordHash) {
+        return null;
       }
 
-      return null;
+      // Verify password against hashed password in database
+      const isValidPassword = bcrypt.compareSync(password, user.passwordHash);
+      if (!isValidPassword) {
+        return null;
+      }
+
+      return {
+        id: user.id.toString(),
+        name: user.name ?? username,
+        email: user.email,
+        role: user.role
+      };
     }
   });
 }

src/lib/init-db.ts

@@ -1,9 +1,11 @@
+import bcrypt from "bcryptjs";
 import prisma, { nowIso } from "./db";
 import { config } from "./config";
 
 /**
  * Ensures the admin user from environment variables exists in the database.
  * This is called during application startup.
+ * The password from environment variables is hashed and stored securely.
  */
 export async function ensureAdminUser(): Promise<void> {
   const adminId = 1; // Must match the hardcoded ID in auth.ts
@@ -11,36 +13,39 @@ export async function ensureAdminUser(): Promise<void> {
   const provider = "credentials";
   const subject = config.adminUsername;
 
+  // Hash the admin password for secure storage
+  const passwordHash = bcrypt.hashSync(config.adminPassword, 12);
+
   // Check if admin user already exists
   const existingUser = await prisma.user.findUnique({
     where: { id: adminId }
   });
 
   if (existingUser) {
-    // Admin user exists, update if needed
-    if (existingUser.email !== adminEmail || existingUser.subject !== subject) {
-      const now = new Date(nowIso());
-      await prisma.user.update({
-        where: { id: adminId },
-        data: {
-          email: adminEmail,
-          subject,
-          updatedAt: now
-        }
-      });
-      console.log(`Updated admin user: ${config.adminUsername}`);
-    }
+    // Admin user exists, update credentials if needed
+    // Always update password hash to handle password changes in env vars
+    const now = new Date(nowIso());
+    await prisma.user.update({
+      where: { id: adminId },
+      data: {
+        email: adminEmail,
+        subject,
+        passwordHash,
+        updatedAt: now
+      }
+    });
+    console.log(`Updated admin user: ${config.adminUsername}`);
     return;
   }
 
-  // Create admin user
+  // Create admin user with hashed password
   const now = new Date(nowIso());
   await prisma.user.create({
     data: {
       id: adminId,
       email: adminEmail,
       name: config.adminUsername,
-      passwordHash: null, // Using environment variable auth, not password hash
+      passwordHash, // Store hashed password instead of plaintext
       role: "admin",
       provider,
       subject,