2GT-RichandClaude Opus 4.8
9e962939ea
Follow-up to the /terminal authorization fix: a full-codebase security review surfaced several more issues, fixed here. All changes are designed to roll out with no interruption to existing deployments — no forced migration, no manual re-key, no boot failure. Self-healing secret management (utils/secrets.ts): - JWT_SECRET / ENCRYPTION_KEY auto-generate to strong values on first boot and persist to the app_data volume (0600, outside the DB) when not set to a strong value in the environment. Replaces the prior behavior of running on the public repo defaults. - decrypt() tries the current key plus every legacy/default key, so existing device credentials keep decrypting after a key change; a startup sweep re-encrypts stale rows forward (db/reencryptCredentials.ts). - verifyToken() accepts the current signing secret plus prior *strong* secrets (never the public defaults), so rotation doesn't invalidate live sessions; sessions signed with a default secret require one re-login. - Dockerfile pre-creates /app/data as the app user so the non-root process can persist to a fresh named volume; app_data volume added to both compose files; compose secret defaults changed to empty (auto-gen). Authorization / input: - Default Socket.IO namespace now requires a valid JWT (was unauthenticated and broadcasting fleet-activity events); frontend sends the token and drops the shared socket on logout. - Webhook delivery blocks SSRF to loopback/private/link-local/CGNAT ranges and pins the request to the validated IP (WebhookService.ts). - Rate limit added to /auth/totp/verify; global mutation backstop on /api. - Password policy (>=10 chars, letter+digit) enforced on set/change/create. - system.ts used verifyToken as middleware (always 500); now requireAuth. Hardening: - CSP + HSTS/nosniff/frame-deny headers in nginx, scoped to allow the OpenStreetMap tile/geocoding hosts the maps use. Docs/tests: - README secret section rewritten for the self-healing model. - New unit tests for secret resolution, persistence, rotation, and legacy-key decryption (97 tests pass). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
1.1 KiB
Docker
43 lines
1.1 KiB
Docker
# Stage 1: Build
|
|
FROM node:26-alpine AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package*.json ./
|
|
RUN npm install
|
|
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
# Stage 2: Production
|
|
FROM node:26-alpine AS production
|
|
|
|
WORKDIR /app
|
|
|
|
# Install only production dependencies
|
|
COPY package*.json ./
|
|
RUN npm install --omit=dev && npm cache clean --force
|
|
|
|
# Install arp-scan for server-side MAC→IP ARP discovery.
|
|
# libcap is needed to set file capabilities so it runs without root.
|
|
# openssl is needed for self-signed certificate generation.
|
|
RUN apk add --no-cache arp-scan libcap openssl \
|
|
&& setcap cap_net_raw+ep /usr/bin/arp-scan
|
|
|
|
# Copy built files
|
|
COPY --from=builder /app/dist ./dist
|
|
|
|
# Create writable data directories. Pre-creating them (owned by appuser after
|
|
# the chown below) means a fresh named volume mounted here inherits appuser
|
|
# ownership, so the non-root process can persist backups and secrets.
|
|
RUN mkdir -p /app/backups /app/data
|
|
|
|
# Create non-root user
|
|
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
|
|
RUN chown -R appuser:appgroup /app
|
|
USER appuser
|
|
|
|
EXPOSE 3001
|
|
|
|
CMD ["node", "dist/index.js"]
|