rogee/gochat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): harden auth and secret handling (HH-444) (#101)

Browse Source 
* fix(security): harden auth and credential handling (HH-444)

* fix(security): address HH-444 review blockers

* fix(security): close remaining HH-444 review blockers

---------

Co-authored-by: Rogee <rogee@ipao.vip>
This commit is contained in:
Rogee
2026-08-22 15:45:06 +08:00
committed by GitHub
co-authored by rogee
parent e1557e7f21
commit f719529d66
81 changed files with 2149 additions and 474 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+29 -8
View File
@@ -225,7 +225,11 @@ jobs:
env:
GOCHAT_IMAGE_REF: gochat:production-smoke
GOCHAT_PORT: "38080"
GOCHAT_SERVER_CORS_ALLOWED_ORIGINS: https://chat.example.test
GOCHAT_SERVER_CORS_ALLOWED_ORIGINS: https://chat.ci.rogeecn.com
GOCHAT_DATABASE_DSN: "postgres://gochat:ci-postgres-secret@postgres:5432/gochat_production?sslmode=verify-full&sslrootcert=/run/tls/ca.crt"
GOCHAT_REDIS_DSN: "rediss://:ci-redis-secret@redis:6379/0"
GOCHAT_ENCRYPTION_AES_KEY: MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=
GOCHAT_TLS_DIR: ${{ github.workspace }}/.tmp/gochat-tls
POSTGRES_PASSWORD: ci-postgres-secret
REDIS_PASSWORD: ci-redis-secret
MEILI_MASTER_KEY: ci-meili-secret-16
@@ -271,20 +275,37 @@ jobs:
'test -s /app/configs/config.production.yaml && find /app/migrations -maxdepth 1 -type f -name "*.sql" -print -quit | grep -q . && test -s /app/frontend/dist/index.html && test -s /app/frontend/dist/favicon-32x32.png'
docker run --rm --entrypoint sh "$SHANGWUTONG_IMAGE_REF" -c \
'test -x /usr/local/bin/shangwutong && test -d /data && test -d /backup && test "$(id -u)" -eq 10001'
- name: Create trusted TLS fixtures
run: |
mkdir -p "$GOCHAT_TLS_DIR"
openssl req -x509 -newkey rsa:2048 -nodes -days 1 -subj '/CN=GoChat CI CA' \
-keyout "$GOCHAT_TLS_DIR/ca.key" -out "$GOCHAT_TLS_DIR/ca.crt"
for service in postgres redis; do
openssl req -newkey rsa:2048 -nodes -subj "/CN=$service" \
-addext "subjectAltName=DNS:$service" \
-keyout "$GOCHAT_TLS_DIR/$service.key" -out "$GOCHAT_TLS_DIR/$service.csr"
printf 'subjectAltName=DNS:%s\n' "$service" > "$GOCHAT_TLS_DIR/$service.ext"
openssl x509 -req -days 1 -CA "$GOCHAT_TLS_DIR/ca.crt" -CAkey "$GOCHAT_TLS_DIR/ca.key" \
-CAcreateserial -extfile "$GOCHAT_TLS_DIR/$service.ext" \
-in "$GOCHAT_TLS_DIR/$service.csr" -out "$GOCHAT_TLS_DIR/$service.crt"
done
chmod 600 "$GOCHAT_TLS_DIR"/*.key
chmod 644 "$GOCHAT_TLS_DIR"/*.crt
- name: Start production Compose and smoke core pages
run: |
deploy/docker/preflight_test.sh
docker compose -f deploy/docker/docker-compose.prod.yml config --format json | python3 -c 'import json, os, sys; config = json.load(sys.stdin); assert all(config["services"][service]["environment"]["GOCHAT_JWT_PREVIOUS_SECRETS"] == os.environ["GOCHAT_JWT_PREVIOUS_SECRETS"] for service in ("gochat", "worker"))'
docker compose -f deploy/docker/docker-compose.prod.yml --profile ops run --rm migrate
docker compose -f deploy/docker/docker-compose.prod.yml up -d --wait gochat shangwutong
docker compose -f deploy/docker/docker-compose.prod.yml up -d worker
compose=(docker compose -f deploy/docker/docker-compose.prod.yml -f deploy/docker/docker-compose.prod-smoke.yml)
"${compose[@]}" --profile ops run --rm migrate
"${compose[@]}" up -d --wait gochat shangwutong
"${compose[@]}" up -d worker
for service in gochat worker shangwutong; do
container_id="$(docker compose -f deploy/docker/docker-compose.prod.yml ps -q "$service")"
container_id="$("${compose[@]}" ps -q "$service")"
test -n "$container_id"
test "$(docker inspect --format '{{.State.Status}}' "$container_id")" = running
done
for service in gochat shangwutong; do
container_id="$(docker compose -f deploy/docker/docker-compose.prod.yml ps -q "$service")"
container_id="$("${compose[@]}" ps -q "$service")"
test "$(docker inspect --format '{{.State.Health.Status}}' "$container_id")" = healthy
done
curl -fsS "http://127.0.0.1:$GOCHAT_PORT/health" | grep -q '"status":"healthy"'
@@ -292,12 +313,12 @@ jobs:
curl -fsS "http://127.0.0.1:$GOCHAT_PORT/runtime-config.js" | grep -q 'window.__GOCHAT_CONFIG__'
curl -fsS -o "$RUNNER_TEMP/favicon-32x32.png" "http://127.0.0.1:$GOCHAT_PORT/favicon-32x32.png"
test -s "$RUNNER_TEMP/favicon-32x32.png"
docker compose -f deploy/docker/docker-compose.prod.yml exec -T shangwutong \
"${compose[@]}" exec -T shangwutong \
wget -q -T 3 -O - http://127.0.0.1:9100/readyz | grep -q '"status":"ready"'
- name: Stop production Compose
if: always()
run: |
docker compose -f deploy/docker/docker-compose.prod.yml down -v
docker compose -f deploy/docker/docker-compose.prod.yml -f deploy/docker/docker-compose.prod-smoke.yml down -v
docker rm -f gochat-ci-registry || true
release: