security: contain GIMP cryptominer + LMMS reverse-shell backdoor (2026-11-11)

- Weblog desktops were unauthenticated and publicly reachable (entry vector)
- Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified
- Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth)
- GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined
- Removed /home/sam:ro mount from GIMP (was exposing secrets to the container)
- Service-controller restarted (was dead, which is why toggles did nothing)
- Incident record + captured payload in docs/incident-2026-11-11*

music/docker-compose.yml

@@ -11,6 +11,8 @@ services:
     container_name: lmms
     restart: unless-stopped
     environment:
+      CUSTOM_USER: ${WEBTOP_USER:-family}
+      PASSWORD: ${WEBTOP_PASSWORD}
       PUID: 1000
       PGID: 100
       TZ: Australia/Perth