update security

compose.yaml

@@ -1,5 +1,11 @@
 name: tapm
 
+x-default-logging: &default-logging
+  driver: json-file
+  options:
+    max-size: "10m"
+    max-file: "5"
+
 services:
   broker:
     container_name: tapm-broker
@@ -10,6 +16,8 @@ services:
         required: false
     restart: unless-stopped
     init: true
+    pids_limit: 128
+    logging: *default-logging
     read_only: true
     networks:
       - edge
@@ -32,6 +40,8 @@ services:
     container_name: tapm-gitea
     image: docker.gitea.com/gitea:1.26.4-rootless
     restart: unless-stopped
+    pids_limit: 512
+    logging: *default-logging
     networks:
       - edge
     volumes:
@@ -61,6 +71,9 @@ services:
     container_name: tapm-nginx
     image: nginx:1.28-alpine
     restart: unless-stopped
+    read_only: true
+    pids_limit: 128
+    logging: *default-logging
     networks:
       - edge
     ports:
@@ -76,10 +89,16 @@ services:
       SSL_CERTIFICATE_KEY_FILE: ${SSL_CERTIFICATE_KEY_FILE:-privkey.pem}
     security_opt:
       - no-new-privileges:true
+    tmpfs:
+      - /etc/nginx/conf.d:size=1m,mode=0755
+      - /var/cache/nginx:size=32m,mode=0755
+      - /var/run:size=1m,mode=0755
 
   certbot:
     image: certbot/certbot:v5.7.0
     profiles: ["tools"]
+    pids_limit: 128
+    logging: *default-logging
     volumes:
       - ./config/letsencrypt:/etc/letsencrypt
       - ./config/certbot-webroot:/var/www/certbot