feat: establish secure update foundation

compose.yml

@@ -1,49 +1,29 @@
-x-domain-control-image: &domain-control-image
-  image: git.j-mahler.de/admin/domain-control-webinterface-prod:v1.3.0
-
 services:
   dyndns:
-    <<: *domain-control-image
+    image: &image git.j-mahler.de/admin/domain-control-webinterface-prod:v1.4.0
     restart: unless-stopped
-    ports:
-      - "9090:8080"
-    volumes:
-      - dyndns-data:/data
-      - dyndns-secrets:/secrets
-      - dyndns-update-control:/run/domain-control-update
-    labels:
-      de.j-mahler.domain-control.role: app
+    stop_grace_period: 20s
+    ports: ["9090:8080"]
+    volumes: ["dyndns-data:/data", "dyndns-secrets:/secrets", "dyndns-update-control:/run/domain-control-update"]
+    labels: {de.j-mahler.domain-control.role: app}
     read_only: true
-    tmpfs:
-      - /tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
+    tmpfs: ["/tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777"]
+    security_opt: [no-new-privileges:true]
+    cap_drop: [ALL]
 
   update-agent:
-    <<: *domain-control-image
+    image: *image
     restart: unless-stopped
     user: "0:10001"
-    entrypoint:
-      - /usr/local/bin/update-agent
-    healthcheck:
-      disable: true
+    command: [update-agent]
+    healthcheck: {disable: true}
     network_mode: none
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - dyndns-update-control:/run/domain-control-update
+    volumes: ["/var/run/docker.sock:/var/run/docker.sock", "dyndns-update-control:/run/domain-control-update"]
     read_only: true
-    tmpfs:
-      - /tmp:rw,noexec,nosuid,nodev,size=4m,mode=1777
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
+    tmpfs: ["/tmp:rw,noexec,nosuid,nodev,size=4m,mode=1777"]
+    security_opt: [no-new-privileges:true]
+    cap_drop: [ALL]
     pids_limit: 32
     mem_limit: 64m
 
-volumes:
-  dyndns-data:
-  dyndns-secrets:
-  dyndns-update-control:
+volumes: {dyndns-data: {}, dyndns-secrets: {}, dyndns-update-control: {}}