Feat: Fixing up docker

.env.example

@@ -2,6 +2,8 @@
 GITDB_REPOSITORY_URL=https://github.com/your-org/your-gitdb-repository.git
 GITDB_ENCRYPTION_KEY=replace-with-a-long-random-secret
 
+ORIGIN=http://localhost:3000
+
 # Optional GitDB configuration
 GITDB_BRANCH=main
 GITDB_DATA_PATH=./data/gitdb

.github/copilot-instructions.md

@@ -54,9 +54,15 @@ riesgo y mapeos de herramientas. Los modulos actuales son `auth`, `config`, `org
 `projects`, `storage` y `code-report`. Las rutas deben importar desde el `index.ts` publico.
 
 GitDB es la unica fuente de verdad para usuarios, roles, API keys, organizaciones, proyectos,
-metadata de storage y code reports. Se configura con `GITDB_REPOSITORY_URL` y cada escritura es
-un commit auditable. Usar `getGitDb()` y `src/lib/database/schemas.ts`; no añadir otra base de
-datos sin discutir la arquitectura y planificar la migracion.
+metadata de storage y code reports. Se configura con `GITDB_REPOSITORY_URL` (URLs HTTPS o SSH
+como `git@github.com:user/repo.git`, `git@bitbucket.org:team/repo.git`, o `git@gitlab.com:group/repo.git`)
+y cada escritura es un commit auditable. Usar `getGitDb()` y `src/lib/database/schemas.ts`;
+no añadir otra base de datos sin discutir la arquitectura y planificar la migracion. La imagen Docker
+incluye `openssh-client` con fingerprints SSH preconfigurados para GitHub, Bitbucket y GitLab;
+en produccion, asegurar que las credenciales SSH esten disponibles via `SSH_AUTH_SOCK` o directorio montado.
+
+La variable `ORIGIN` fija el origen de la aplicacion (ej: `http://localhost:3000`) para que el
+CSRF Origin check de SvelteKit no dependa del header Host, previniendo bypass en proxys.
 
 ## RBAC y seguridad
 

CLAUDE.md

@@ -88,6 +88,15 @@ metadata, and code reports are GitDB entities in the repository configured by
 `src/lib/database/schemas.ts`; do not add another database or persistence backend without an
 architecture discussion and migration plan.
 
+`GITDB_REPOSITORY_URL` supports both HTTPS and SSH URLs (e.g., `git@github.com:user/repo.git`).
+The Docker image includes `openssh-client` and pre-configures the SSH key fingerprints for GitHub,
+Bitbucket, and GitLab; in production, ensure SSH authentication credentials are available via
+`SSH_AUTH_SOCK` or a mounted SSH directory.
+
+`ORIGIN` environment variable pins the application's public origin (e.g., `http://localhost:3000`).
+SvelteKit's CSRF Origin check depends on this value instead of deriving it from the incoming Host
+header, preventing bypasses when running behind a proxy that rewrites Host headers.
+
 ## Authorization
 
 Permission grants are always scope-prefixed and match the catalog in `src/lib/config/permissions.ts`

Dockerfile

@@ -22,8 +22,11 @@ WORKDIR /app
 
 ENV NODE_ENV=production
 
-# GitDB clones and syncs its backing repository at runtime.
-RUN apk add --no-cache git
+# GitDB clones and syncs its backing repository at runtime; openssh-client
+# provides the ssh binary git needs for git@ remotes.
+RUN apk add --no-cache git openssh-client && \
+    mkdir -p /root/.ssh && \
+    ssh-keyscan -t rsa,ecdsa,ed25519 github.com bitbucket.org gitlab.com >> /root/.ssh/known_hosts
 
 # SvelteKit adapter-node output lives in build/
 COPY --from=builder /app/build ./build

docker-compose.yml

@@ -6,8 +6,10 @@ services:
       - .env
     environment:
       GITDB_DATA_PATH: /app/data/gitdb
+      SSH_AUTH_SOCK: /ssh-agent
     ports:
       - '3000:3000'
     volumes:
       - ./data:/app/data
+      - /run/host-services/ssh-auth.sock:/ssh-agent
     restart: unless-stopped