Devin
ad69385beb
backend/api/rest/server.go:
- NewServer() now delegates to loadJWTSecret(), which:
- Rejects JWT_SECRET < 32 bytes (log.Fatal).
- Requires JWT_SECRET when APP_ENV=production or GO_ENV=production.
- Generates a 32-byte crypto/rand ephemeral secret in dev only.
- Treats rand.Read failure as fatal (removes the prior time-based
fallback that was deterministic and forgeable).
- Default Content-Security-Policy rewritten:
- Drops 'unsafe-inline' and 'unsafe-eval'.
- Drops private CIDRs (192.168.11.221:854[5|6]).
- Adds frame-ancestors 'none', base-uri 'self', form-action 'self'.
- CSP_HEADER is required in production; fatal if unset there.
backend/api/rest/server_security_test.go (new):
- Covers the three loadJWTSecret() paths (valid, whitespace-trimmed,
ephemeral in dev).
- Covers isProductionEnv() across APP_ENV / GO_ENV combinations.
- Asserts defaultDevCSP contains no unsafe directives or private CIDRs
and includes the frame-ancestors / base-uri / form-action directives.
scripts/*.sh:
- Removed '***REDACTED-LEGACY-PW***' default value from SSH_PASSWORD / NEW_PASSWORD in
7 helper scripts. Each script now fails with exit 2 and points to
docs/SECURITY.md if the password isn't supplied via env or argv.
EXECUTE_DEPLOYMENT.sh, EXECUTE_NOW.sh:
- Replaced hardcoded DB_PASSWORD='***REDACTED-LEGACY-PW***' with a ':?' guard that
aborts with a clear error if DB_PASSWORD (and, for EXECUTE_DEPLOYMENT,
RPC_URL) is not exported. Other env vars keep sensible non-secret
defaults via ${VAR:-default}.
README.md:
- Removed the hardcoded Database Password / RPC URL lines. Replaced with
an env-variable reference table pointing at docs/SECURITY.md and
docs/DATABASE_CONNECTION_GUIDE.md.
docs/DEPLOYMENT.md:
- Replaced 'PASSWORD: SSH password (default: ***REDACTED-LEGACY-PW***)' with a
required-no-default contract and a link to docs/SECURITY.md.
docs/SECURITY.md (new):
- Full secret inventory keyed to the env variable name and the file that
consumes it.
- Five-step rotation checklist covering the Postgres role, the Proxmox
VM SSH password, JWT_SECRET, vendor API keys, and a gitleaks-based
history audit.
- Explicit note that merging secret-scrub PRs does NOT invalidate
already-leaked credentials; rotation is the operator's responsibility.
Verification:
- go build ./... + go vet ./... pass clean.
- Targeted tests (LoadJWTSecret*, IsProduction*, DefaultDevCSP*) pass.
Advances completion criterion 2 (Secrets & config hardened). Residual
leakage from START_HERE.md / LETSENCRYPT_CONFIGURATION_GUIDE.md is
handled by PR #2 (doc consolidation), which deletes those files.
80 lines
2.3 KiB
Bash
Executable File
80 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Set Root Password for Proxmox LXC Container - Correct Method
|
|
# Must be run on Proxmox host
|
|
|
|
set -euo pipefail
|
|
|
|
VMID="${1:-2500}"
|
|
PASSWORD="${NEW_PASSWORD:-${2:-}}"
|
|
|
|
if [ -z "${PASSWORD}" ]; then
|
|
echo "ERROR: NEW_PASSWORD is required. Pass it as an argument or export NEW_PASSWORD in the environment." >&2
|
|
echo " Hardcoded default removed for security; see docs/SECURITY.md." >&2
|
|
exit 2
|
|
fi
|
|
|
|
if ! command -v pct >/dev/null 2>&1; then
|
|
echo "Error: pct command not found"
|
|
echo "This script must be run on the Proxmox host"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Setting root password for VMID $VMID..."
|
|
echo "Password: $PASSWORD"
|
|
echo ""
|
|
|
|
# Method 1: Use pct exec to run passwd command
|
|
echo "Method 1: Using pct exec with echo and passwd..."
|
|
echo "$PASSWORD" | pct exec "$VMID" -- passwd root 2>&1 || {
|
|
echo "Method 1 failed, trying alternative..."
|
|
|
|
# Method 2: Use pct enter (interactive)
|
|
echo ""
|
|
echo "Method 2: Interactive method"
|
|
echo "Run the following command manually:"
|
|
echo " echo '$PASSWORD' | pct exec $VMID -- passwd root"
|
|
echo ""
|
|
echo "Or enter the container and set password:"
|
|
echo " pct enter $VMID"
|
|
echo " passwd root"
|
|
echo " (enter password when prompted)"
|
|
echo " exit"
|
|
echo ""
|
|
|
|
# Method 3: Use chpasswd
|
|
echo "Method 3: Using chpasswd..."
|
|
echo "root:$PASSWORD" | pct exec "$VMID" -- chpasswd 2>&1 && {
|
|
echo "✅ Password set successfully using chpasswd"
|
|
exit 0
|
|
} || {
|
|
echo "Method 3 also failed"
|
|
echo ""
|
|
echo "Trying direct passwd with stdin..."
|
|
}
|
|
}
|
|
|
|
# Method 4: Direct passwd with expect-like approach
|
|
echo ""
|
|
echo "Attempting direct password setting..."
|
|
(echo "$PASSWORD"; echo "$PASSWORD") | pct exec "$VMID" -- passwd root 2>&1 && {
|
|
echo "✅ Password set successfully"
|
|
} || {
|
|
echo ""
|
|
echo "⚠️ Automated methods failed. Use manual method:"
|
|
echo ""
|
|
echo "Manual Method 1 (Interactive):"
|
|
echo " pct enter $VMID"
|
|
echo " passwd root"
|
|
echo " (enter: $PASSWORD)"
|
|
echo " exit"
|
|
echo ""
|
|
echo "Manual Method 2 (One-liner):"
|
|
echo " pct exec $VMID -- bash -c \"echo 'root:$PASSWORD' | chpasswd\""
|
|
echo ""
|
|
echo "Manual Method 3 (SSH if already accessible):"
|
|
echo " ssh root@<container-ip>"
|
|
echo " passwd root"
|
|
echo " (enter: $PASSWORD)"
|
|
}
|
|
|