fix(abstract-node): restrict Grafana permissions and enforce PostgreSQL restart policy

[malakasaray-del]

Motivation

This PR resolves high-severity security and reliability issues within the abstract-node container composition, identified during the workspace-wide security audit.

Previously, Grafana was configured with GF_AUTH_ANONYMOUS_ORG_ROLE: Admin hardcoded. With anonymous access enabled and the login form disabled, this granted administrative rights to any request reaching port 3000[cite: 57]. This exposed the node to severe risks, as an unauthenticated user could create data sources to proxy server-side requests and access internal endpoints, such as the cloud metadata service[cite: 57]. Additionally, the postgres service lacked a restart policy; a crash or host reboot left the database stopped, causing the external-node to loop indefinitely until manual intervention[cite: 57].

Modifications

• Grafana Least Privilege (docker/external-node.yml):
  • Demoted the hardcoded anonymous role from Admin to Viewer (GF_AUTH_ANONYMOUS_ORG_ROLE: "${GRAFANA_ANONYMOUS_ROLE:-Viewer}")[cite: 57]. This restricts unauthenticated access to reading provisioned dashboards only, mitigating the server-side request forgery (SSRF) risk[cite: 57]. Operators requiring admin rights can restore the previous behavior by explicitly setting the GRAFANA_ANONYMOUS_ROLE environment variable[cite: 57].
• Database Reliability (docker/external-node.yml):
  • Added restart: always to the postgres service to ensure it automatically recovers after crashes or host reboots, maintaining the health dependency required by the external-node service[cite: 57].

Checklist

• Format your code according to the Contributor Guide.
• Add unit tests as outlined in the Contributor Guide.
• Update documentation as needed, including docstrings or example tutorials.

---

PR-Codex overview

This PR updates the docker/external-node.yml configuration for a service, enhancing the setup for prometheus, grafana, postgres, and external-node, including health checks, environment variables, and volume management.

Detailed summary

• Added name for the external node service.
• Updated GF_AUTH_ANONYMOUS_ORG_ROLE to default to Viewer.
• Included comments for better understanding of postgres restart policy.
• Enhanced generate-secrets configuration.
• Cleaned up environment variable formatting.
• Defined service health checks and dependencies.
• Organized volume declarations for better clarity.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}