feat: add resilient updates and access controls

compose.yml

@@ -1,12 +1,18 @@
+x-domain-control-image: &domain-control-image
+  image: git.j-mahler.de/admin/domain-control-webinterface-prod:v1.3.0
+
 services:
   dyndns:
-    image: git.j-mahler.de/admin/domain-control-webinterface-prod:v1.2.2
+    <<: *domain-control-image
     restart: unless-stopped
     ports:
       - "9090:8080"
     volumes:
       - dyndns-data:/data
       - dyndns-secrets:/secrets
+      - dyndns-update-control:/run/domain-control-update
+    labels:
+      de.j-mahler.domain-control.role: app
     read_only: true
     tmpfs:
       - /tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777
@@ -15,6 +21,29 @@ services:
     cap_drop:
       - ALL
 
+  update-agent:
+    <<: *domain-control-image
+    restart: unless-stopped
+    user: "0:10001"
+    entrypoint:
+      - /usr/local/bin/update-agent
+    healthcheck:
+      disable: true
+    network_mode: none
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - dyndns-update-control:/run/domain-control-update
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,nodev,size=4m,mode=1777
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    pids_limit: 32
+    mem_limit: 64m
+
 volumes:
   dyndns-data:
   dyndns-secrets:
+  dyndns-update-control: