Infra security fixes: Caddy log redaction, headers and non-root container; dev mounts only the FCM key; deploy records image digests (D-117)
- Caddyfile: access and error logs replace the /i/<code> segment and every query string with REDACTED (regexp filter on request>uri); Authorization stays redacted by default. Deferred response headers: Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy. - Pi compose: caddy as uid 10002 with group 1000, read-only root, cap_drop ALL plus NET_BIND_SERVICE (needed to exec the image's file-capability binary), tmpfs /config and /tmp; install.sh sets /certs 0750 1000:1000 and Caddy's /data to 10002. - deploy.sh and install.sh print the pulled image digests and append them to /opt/kvitt/deployed-digests, warning when a recorded tag changed digest; the workflow prints the pushed digests; kvitt_cicd needs only write:package. - Dev stack: up.sh stages only fcm-service-account.json into infra/dev/secrets/ (git-ignored), mounted read-only at /secrets. - README: restricted cert-sync key required (plain root key not acceptable), remote_ip and log checks, APK download note, owner decisions (backup encryption, APK limit, key form, token scope), overhaul lines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
This commit is contained in:
@@ -13,7 +13,8 @@ KVITT_TAG=CHANGE_ME_TAG
|
||||
HA_HOST=CHANGE_ME_HA_HOST
|
||||
# SSH port of the Home Assistant SSH add-on (OQ-3; the "Advanced SSH & Web Terminal" and "Terminal & SSH" add-ons default to 22).
|
||||
HA_PORT=22
|
||||
# SSH user on the Home Assistant Pi (OQ-3; the Home Assistant SSH add-ons log in as root, or the user set in the add-on).
|
||||
# SSH user on the Home Assistant Pi (OQ-3). root only with the restricted key line of infra/README.md step 3; otherwise a
|
||||
# dedicated non-root user that can only read HA_CERT_DIR (D-117). A plain, unrestricted root key is not acceptable.
|
||||
HA_USER=CHANGE_ME_HA_USER
|
||||
# Directory holding fullchain.pem and privkey.pem on the Home Assistant Pi (OQ-3; /ssl on Home Assistant OS).
|
||||
HA_CERT_DIR=CHANGE_ME_HA_CERT_DIR
|
||||
|
||||
+23
-1
@@ -1,6 +1,15 @@
|
||||
# Kvitt Caddyfile (SPEC §10.5.2, D-117). Installed as /opt/kvitt/Caddyfile; cert-sync reloads it through the admin API.
|
||||
{
|
||||
admin 0.0.0.0:2019
|
||||
auto_https off
|
||||
# Caddy's own error log (for example a 502 when the server is down) carries the request too: same URI filter.
|
||||
log default {
|
||||
output stderr
|
||||
format filter {
|
||||
request>uri regexp `^(/i/)[^?]+|([?]).+` `${1}${2}REDACTED`
|
||||
wrap json
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
icehack.asuscomm.com:8443 {
|
||||
@@ -8,9 +17,22 @@ icehack.asuscomm.com:8443 {
|
||||
request_body {
|
||||
max_size 6MB
|
||||
}
|
||||
# Set after the server's response headers (defer), so a header the server also sends appears once.
|
||||
header {
|
||||
defer
|
||||
Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
|
||||
X-Content-Type-Options nosniff
|
||||
X-Frame-Options DENY
|
||||
Referrer-Policy no-referrer
|
||||
}
|
||||
reverse_proxy server:8080
|
||||
# Access log: the invite code in /i/<code> and every query string (the inviter's name in ?from=) become
|
||||
# REDACTED (SPEC §8.7); the Authorization header is redacted by Caddy's default.
|
||||
log {
|
||||
output stdout
|
||||
format json
|
||||
format filter {
|
||||
request>uri regexp `^(/i/)[^?]+|([?]).+` `${1}${2}REDACTED`
|
||||
wrap json
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -17,8 +17,22 @@ services:
|
||||
# Official image, pinned by version and multi-arch index digest (resolved 2026-10-18, infra/README.md).
|
||||
image: docker.io/library/caddy:2.11.7@sha256:685ae3d7c34d9b5f8caeddc5d14051db7bbd88ff1f5a2fa0c16bd8ca328fb7af
|
||||
restart: unless-stopped
|
||||
# Non-root (D-117): uid 10002, plus group 1000 (cert-sync's group) to read the 0640 files in the 0750 /certs.
|
||||
# 8443 needs no capability, but the image's /usr/bin/caddy carries the file capability cap_net_bind_service=ep,
|
||||
# and the kernel refuses to exec it when that capability is not in the bounding set (checked 2026-10-18:
|
||||
# "exec container process /usr/bin/caddy: Operation not permitted" with cap_drop ALL alone). So NET_BIND_SERVICE
|
||||
# is the one capability kept. caddy_data (/data) is owned by 10002 (install.sh); /config (autosave of the loaded
|
||||
# config) and /tmp are tmpfs, the rest of the root filesystem is read-only.
|
||||
user: "10002:10002"
|
||||
group_add: ["1000"]
|
||||
read_only: true
|
||||
cap_drop: [ALL]
|
||||
cap_add: [NET_BIND_SERVICE]
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
tmpfs:
|
||||
- /config
|
||||
- /tmp
|
||||
mem_limit: 64m
|
||||
ports:
|
||||
- "8443:8443"
|
||||
|
||||
+4
-2
@@ -4,7 +4,8 @@
|
||||
# migration and the Pi cannot tell beforehand (the rule "backup before a deploy with a migration" is applied
|
||||
# to every deploy); skipped when no database exists yet, or with --skip-backup (rollback while Drive is down)
|
||||
# 2. sets KVITT_TAG in /opt/kvitt/.env (the previous tag is kept in /opt/kvitt/previous-tag)
|
||||
# 3. docker compose pull && docker compose up -d, waits for server to be healthy, prints GET /health
|
||||
# 3. docker compose pull, prints the pulled image digests and appends them to /opt/kvitt/deployed-digests (D-117),
|
||||
# docker compose up -d, waits for server to be healthy, prints GET /health
|
||||
# Rollback after a failed migration: /opt/kvitt/deploy.sh "$(cat /opt/kvitt/previous-tag)"; if a migration had
|
||||
# partially applied, restore the pre-deploy backup (infra/RESTORE.md).
|
||||
set -euo pipefail
|
||||
@@ -17,7 +18,7 @@ tag=""
|
||||
for arg in "$@"; do
|
||||
case "$arg" in
|
||||
--skip-backup) skip_backup=1 ;;
|
||||
-h|--help) sed -n '2,10p' "$0"; exit 0 ;;
|
||||
-h|--help) sed -n '2,11p' "$0"; exit 0 ;;
|
||||
-*) die "unknown option $arg" ;;
|
||||
*) [[ -z "$tag" ]] || die "usage: $0 <tag> [--skip-backup]"; tag=$arg ;;
|
||||
esac
|
||||
@@ -47,6 +48,7 @@ if ! compose pull; then
|
||||
[[ -n "$current" ]] && env_set KVITT_TAG "$current"
|
||||
die "pull of $tag failed; KVITT_TAG left at ${current:-its old value}"
|
||||
fi
|
||||
record_digests "$tag"
|
||||
compose up -d --remove-orphans
|
||||
if ! wait_healthy server 180; then
|
||||
compose logs --tail 50 server || true
|
||||
|
||||
+10
-4
@@ -8,7 +8,8 @@
|
||||
# 4. trusts the plain-HTTP registry in /etc/docker/daemon.json (insecure-registries) and logs in when credentials are set
|
||||
# 5. copies compose.yaml, Caddyfile, .env and the operation scripts to /opt/kvitt; a KVITT_TAG that deploy.sh set
|
||||
# in /opt/kvitt/.env is kept, so re-running an older bundle never rolls the server back to the bundle's tag
|
||||
# 6. pulls the images, gives the named volumes their owners, starts the stack, waits for /health
|
||||
# 6. pulls the images (digests recorded in /opt/kvitt/deployed-digests), gives the named volumes their owners,
|
||||
# starts the stack, waits for /health
|
||||
# Uses sudo for /opt/kvitt, the secret files and the Docker daemon configuration.
|
||||
set -euo pipefail
|
||||
bundle="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
@@ -35,7 +36,8 @@ registry_host=${registry%%/*}
|
||||
registry_user=$(env_value KVITT_REGISTRY_USER "$env_src")
|
||||
registry_token=$(env_value KVITT_REGISTRY_TOKEN "$env_src")
|
||||
|
||||
# 3. Directories and secrets. uid 1000 = cert-sync, uid 10001 = server and backup (SPEC §10.2, §10.7, D-023, D-105).
|
||||
# 3. Directories and secrets. uid 1000 = cert-sync, uid 10001 = server and backup, uid 10002 = caddy (SPEC §10.2,
|
||||
# §10.7, D-023, D-105, D-117).
|
||||
say "Creating $KVITT_DIR"
|
||||
sudo install -d -m 0755 -o "$(id -u)" -g "$(id -g)" "$KVITT_DIR" "$KVITT_DIR/import" "$KVITT_DIR/apk"
|
||||
sudo install -d -m 0700 -o root -g root "$KVITT_DIR/secrets"
|
||||
@@ -125,13 +127,17 @@ say "Installed compose.yaml, Caddyfile, .env and the scripts in $KVITT_DIR"
|
||||
# 6. Pull, volume owners, start.
|
||||
compose config --quiet
|
||||
compose pull
|
||||
record_digests "$(env_value KVITT_TAG)"
|
||||
compose create
|
||||
# Named volumes start owned by root; give each its container's uid (the server image has no shell, so the
|
||||
# backup image, which mounts the same data volume, sets /data). Runs as root once per install, then exits.
|
||||
compose run --rm --no-deps -T --user 0:0 --cap-add CHOWN --entrypoint /bin/sh backup \
|
||||
-c 'chown 10001:10001 /data /backups && mkdir -p /data/apk && chown 10001:10001 /data/apk'
|
||||
compose run --rm --no-deps -T --user 0:0 --cap-add CHOWN --entrypoint /bin/sh cert-sync \
|
||||
-c 'chown 1000:1000 /certs'
|
||||
# /certs: cert-sync (1000) writes, Caddy (10002, supplementary group 1000) reads; /data of Caddy: 10002 (D-117).
|
||||
compose run --rm --no-deps -T --user 0:0 --cap-add CHOWN --cap-add FOWNER --entrypoint /bin/sh cert-sync \
|
||||
-c 'chown 1000:1000 /certs && chmod 0750 /certs'
|
||||
compose run --rm --no-deps -T --user 0:0 --cap-add CHOWN --entrypoint /bin/sh caddy \
|
||||
-c 'chown -R 10002:10002 /data'
|
||||
compose up -d --remove-orphans
|
||||
ok=1
|
||||
wait_healthy server 180 || ok=0
|
||||
|
||||
@@ -66,3 +66,36 @@ print_health() {
|
||||
say "GET https://$PUBLIC_HOST:$PUBLIC_PORT/health (via this Pi) failed: $out"
|
||||
return 1
|
||||
}
|
||||
|
||||
# Print the registry digest of every image the stack runs and append one line per image to
|
||||
# $KVITT_DIR/deployed-digests: "<UTC time> <KVITT_TAG> <image reference> <digest>" (D-117). The registry is plain
|
||||
# HTTP on the LAN (D-001), so a swapped image would otherwise go unnoticed: a tag that was recorded before with a
|
||||
# different digest prints a WARNING (expected only for a tag like `latest` that is meant to move).
|
||||
record_digests() {
|
||||
local tag=$1 log=$KVITT_DIR/deployed-digests stamp ref repo digest prev d
|
||||
local -a refs repo_digests
|
||||
stamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||||
mapfile -t refs < <(compose config --images)
|
||||
touch "$log"
|
||||
say "Image digests (also in $log):"
|
||||
for ref in "${refs[@]}"; do
|
||||
[[ -n "$ref" ]] || continue
|
||||
digest=""
|
||||
if [[ "$ref" == *@sha256:* ]]; then
|
||||
digest=${ref#*@}
|
||||
else
|
||||
repo=${ref%:*}
|
||||
read -r -a repo_digests <<< "$(docker image inspect --format '{{range .RepoDigests}}{{.}} {{end}}' "$ref" 2>/dev/null || true)"
|
||||
for d in "${repo_digests[@]}"; do
|
||||
if [[ "$d" == "$repo@"* ]]; then digest=${d#*@}; break; fi
|
||||
done
|
||||
fi
|
||||
[[ -n "$digest" ]] || digest=unknown
|
||||
prev=$(awk -v r="$ref" '$3 == r { d = $4 } END { print d }' "$log")
|
||||
if [[ -n "$prev" && "$prev" != "$digest" ]]; then
|
||||
say "WARNING: $ref was $prev at an earlier deploy and is $digest now: the image behind this tag changed"
|
||||
fi
|
||||
say " $ref $digest"
|
||||
printf '%s %s %s %s\n' "$stamp" "$tag" "$ref" "$digest" >> "$log"
|
||||
done
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user