fix: secure Loki, Blackbox, and Portainer with localhost binding and Traefik+Authentik

- Bind Loki to 127.0.0.1:3100 instead of 0.0.0.0:3100 to prevent external access
- Add Traefik labels for secure HTTPS access with Authentik authentication
- Bind Blackbox Exporter to 127.0.0.1:9115 instead of 0.0.0.0:9115
- Add Traefik labels for secure monitoring dashboard access
- Enable Authentik middleware for Portainer (was disabled temporarily)
- Services are now only accessible through Traefik reverse proxy with HTTPS and SSO

Fixes critical security issues:
- Prevents direct access to monitoring services (CVSS 9.8-9.1)
- Eliminates log file exposure through public Loki port
- Restricts infrastructure reconnaissance via Blackbox exporter
- Enforces authentication for critical management tools

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

opt/00-infrastructure/blackbox/docker-compose.yml

@@ -6,14 +6,24 @@ services:
     container_name: blackbox-exporter
     restart: unless-stopped
     ports:
-      - "9115:9115"
+      - "127.0.0.1:9115:9115"
     volumes:
       - ./blackbox.yml:/etc/blackbox_exporter/config.yml
     command:
       - '--config.file=/etc/blackbox_exporter/config.yml'
     networks:
       - monitoring_monitoring
+      - traefik-public
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.blackbox.rule=Host(`blackbox.ai-impress.com`)"
+      - "traefik.http.routers.blackbox.entrypoints=websecure"
+      - "traefik.http.routers.blackbox.tls.certresolver=cloudflare"
+      - "traefik.http.routers.blackbox.middlewares=authentik@file"
+      - "traefik.http.services.blackbox.loadbalancer.server.port=9115"
 
 networks:
   monitoring_monitoring:
     external: true
+  traefik-public:
+    external: true

opt/00-infrastructure/loki/docker-compose.yml

@@ -6,13 +6,21 @@ services:
     container_name: loki
     restart: unless-stopped
     ports:
-      - "3100:3100"
+      - "127.0.0.1:3100:3100"
     command: -config.file=/etc/loki/local-config.yaml
     volumes:
       - loki-data:/loki
       - ./loki-config.yaml:/etc/loki/local-config.yaml
     networks:
       - monitoring_monitoring
+      - traefik-public
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.loki.rule=Host(`loki.ai-impress.com`)"
+      - "traefik.http.routers.loki.entrypoints=websecure"
+      - "traefik.http.routers.loki.tls.certresolver=cloudflare"
+      - "traefik.http.routers.loki.middlewares=authentik@file"
+      - "traefik.http.services.loki.loadbalancer.server.port=3100"
 
   promtail:
     image: grafana/promtail:latest
@@ -33,3 +41,5 @@ volumes:
 networks:
   monitoring_monitoring:
     external: true
+  traefik-public:
+    external: true