security: contain GIMP cryptominer + LMMS reverse-shell backdoor (2026-11-11)

- Weblog desktops were unauthenticated and publicly reachable (entry vector)
- Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified
- Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth)
- GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined
- Removed /home/sam:ro mount from GIMP (was exposing secrets to the container)
- Service-controller restarted (was dead, which is why toggles did nothing)
- Incident record + captured payload in docs/incident-2026-11-11*

docker-compose.yml

@@ -187,6 +187,8 @@ services:
     profiles: ["tools"]
     restart: unless-stopped
     environment:
+      CUSTOM_USER: ${WEBTOP_USER:-family}
+      PASSWORD: ${WEBTOP_PASSWORD}
       PUID: 1000
       PGID: 100
       TZ: Australia/Melbourne
@@ -196,7 +198,9 @@ services:
     volumes:
       - gimp-config:/config
       - /mnt/data/family-home-lab/shared-media:/media:rw
-      - /home/sam:/home/sam:ro
+      # SECURITY: the whole home dir used to be mounted read-only here. Malware in
+      # this container could read ~/.ssh and ~/.config/environment.d/*secrets*.
+      # Removed 2026-11-11 after the GIMP compromise (see docs/incident-2026-11-11.md).
       - /home/sam/Downloads:/home/abc/Downloads
       - /home/sam/Pictures:/home/abc/Pictures
     networks: [fhl-net]
@@ -208,6 +212,8 @@ services:
     profiles: ["tools"]
     restart: unless-stopped
     environment:
+      CUSTOM_USER: ${WEBTOP_USER:-family}
+      PASSWORD: ${WEBTOP_PASSWORD}
       PUID: 1000
       PGID: 100
       TZ: Australia/Perth
@@ -224,6 +230,8 @@ services:
     profiles: ["tools"]
     restart: unless-stopped
     environment:
+      CUSTOM_USER: ${WEBTOP_USER:-family}
+      PASSWORD: ${WEBTOP_PASSWORD}
       PUID: 1000
       PGID: 100
       TZ: Australia/Perth