security: contain GIMP cryptominer + LMMS reverse-shell backdoor (2026-11-11)

- Weblog desktops were unauthenticated and publicly reachable (entry vector)
- Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified
- Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth)
- GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined
- Removed /home/sam:ro mount from GIMP (was exposing secrets to the container)
- Service-controller restarted (was dead, which is why toggles did nothing)
- Incident record + captured payload in docs/incident-2026-11-11*

.env.example

@@ -30,3 +30,10 @@ IMAGE_AUDIO=lscr.io/linuxserver/webtop:latest
 
 # ON/OFF service-controller token (host-side; real value injected at deploy)
 SC_TOKEN=change-me
+
+# --- Webtop desktops (GIMP / Kdenlive / Audacity / LMMS) ---
+# Native login for the LinuxServer webtop web desktops. Without these the
+# desktop is served with NO authentication. Also gated at Caddy with
+# `import basic-auth`. Set a long random value; never commit it.
+WEBTOP_USER=family
+WEBTOP_PASSWORD=change-me-to-a-long-random-string