fix: harden extension templates and APE API key verification

dream-server/extensions/services/ape/main.py

@@ -246,7 +246,7 @@ def write_audit(entry: dict) -> None:
 
 
 async def verify_api_key(x_api_key: Optional[str] = Header(None)):
-    if API_KEY and x_api_key != API_KEY:
+    if API_KEY and not secrets.compare_digest(x_api_key or "", API_KEY):
         raise HTTPException(status_code=401, detail="Invalid API key")
     return True
 

dream-server/extensions/templates/compose-gpu-only.yaml

@@ -61,7 +61,7 @@ services:
     restart: unless-stopped
 
     ports:
-      - "${MY_SERVICE_PORT:-8080}:8080"
+      - "127.0.0.1:${MY_SERVICE_PORT:-8080}:8080"
 
     volumes:
       - ./data/my-service/models:/models

dream-server/extensions/templates/compose-template.yaml

@@ -58,7 +58,7 @@ services:
 
     ports:
       # External port (user-facing) : Internal port (container)
-      - "${MY_SERVICE_PORT:-1234}:1234"
+      - "127.0.0.1:${MY_SERVICE_PORT:-1234}:1234"
 
     deploy:
       resources: