fix(security): harden auth and secret handling (HH-444) (#101)

* fix(security): harden auth and credential handling (HH-444)

* fix(security): address HH-444 review blockers

* fix(security): close remaining HH-444 review blockers

---------

Co-authored-by: Rogee <rogee@ipao.vip>

deploy/docker/docker-compose.prod-smoke.yml

@@ -0,0 +1,48 @@
+services:
+  postgres:
+    entrypoint:
+      - /bin/sh
+      - -ec
+      - |
+        install -o postgres -g postgres -m 600 /run/tls/postgres.key /var/lib/postgresql/server.key
+        install -o postgres -g postgres -m 644 /run/tls/postgres.crt /var/lib/postgresql/server.crt
+        exec docker-entrypoint.sh postgres -c ssl=on -c ssl_cert_file=/var/lib/postgresql/server.crt -c ssl_key_file=/var/lib/postgresql/server.key
+    command: []
+    volumes:
+      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro
+
+  redis:
+    entrypoint:
+      - /bin/sh
+      - -ec
+      - |
+        install -o redis -g redis -m 600 /run/tls/redis.key /data/redis.key
+        install -o redis -g redis -m 644 /run/tls/redis.crt /data/redis.crt
+        exec /usr/bin/setpriv --reuid redis --regid redis --clear-groups redis-server --port 0 --tls-port 6379 --tls-cert-file /data/redis.crt --tls-key-file /data/redis.key --tls-ca-cert-file /run/tls/ca.crt --tls-auth-clients no --requirepass "$${REDIS_PASSWORD}" --appendonly yes
+    command: []
+    volumes:
+      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "redis-cli --tls --cacert /run/tls/ca.crt -h redis -a '$${REDIS_PASSWORD}' ping",
+        ]
+
+  gochat:
+    environment:
+      SSL_CERT_FILE: /run/tls/ca.crt
+    volumes:
+      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro
+
+  worker:
+    environment:
+      SSL_CERT_FILE: /run/tls/ca.crt
+    volumes:
+      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro
+
+  migrate:
+    environment:
+      SSL_CERT_FILE: /run/tls/ca.crt
+    volumes:
+      - ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro

deploy/docker/docker-compose.prod.yml

@@ -7,15 +7,18 @@ x-gochat-environment: &gochat-environment
   GOCHAT_SERVER_PORT: 3000
   GOCHAT_SERVER_MODE: release
   GOCHAT_SERVER_CORS_ALLOWED_ORIGINS: ${GOCHAT_SERVER_CORS_ALLOWED_ORIGINS:?set production CORS origins}
-  GOCHAT_DATABASE_DSN: ${GOCHAT_DATABASE_DSN:-postgres://${POSTGRES_USER:-gochat}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-gochat_production}?sslmode=disable}
+  GOCHAT_DATABASE_DSN: ${GOCHAT_DATABASE_DSN:?set an external PostgreSQL DSN with sslmode=verify-ca or verify-full}
   GOCHAT_DATABASE_RUN_MIGRATIONS: "false"
   GOCHAT_DATABASE_MIGRATIONS_PATH: /app/migrations
-  GOCHAT_REDIS_DSN: redis://:${REDIS_PASSWORD:?set REDIS_PASSWORD}@redis:6379
+  GOCHAT_REDIS_DSN: ${GOCHAT_REDIS_DSN:?set an external Redis rediss:// DSN}
   GOCHAT_SEARCH_ENGINE: meilisearch
   GOCHAT_SEARCH_HOST: http://meilisearch:7700
   GOCHAT_SEARCH_API_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY}
   GOCHAT_JWT_SECRET: ${GOCHAT_JWT_SECRET:?set GOCHAT_JWT_SECRET}
   GOCHAT_JWT_PREVIOUS_SECRETS: ${GOCHAT_JWT_PREVIOUS_SECRETS:-}
+  GOCHAT_ENCRYPTION_ENABLED: "true"
+  GOCHAT_ENCRYPTION_CURRENT_KEY_VERSION: ${GOCHAT_ENCRYPTION_CURRENT_KEY_VERSION:-1}
+  GOCHAT_ENCRYPTION_AES_KEY: ${GOCHAT_ENCRYPTION_AES_KEY:?set a base64-encoded 32-byte encryption key}
   GOCHAT_LOG_LEVEL: info
   GOCHAT_LOG_FORMAT: json
   GOCHAT_STORAGE_PROVIDER: local
@@ -143,7 +146,6 @@ services:
     restart: "no"
     environment:
       <<: *gochat-environment
-      GOCHAT_DATABASE_DSN: postgres://${POSTGRES_USER:-gochat}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-gochat_production}?sslmode=disable&lock_timeout=5000&statement_timeout=900000
       GOCHAT_DATABASE_RUN_MIGRATIONS: "false"
 
   backup:
@@ -156,7 +158,7 @@ services:
     entrypoint: ["/app/scripts/db_backup.sh"]
     restart: "no"
     environment:
-      GOCHAT_DATABASE_DSN: postgres://${POSTGRES_USER:-gochat}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-gochat_production}?sslmode=disable
+      GOCHAT_DATABASE_DSN: ${GOCHAT_DATABASE_DSN:?set an external PostgreSQL DSN with sslmode=verify-ca or verify-full}
       GOCHAT_STORAGE_PATH: /source/storage/uploads
       GOCHAT_CONNECTOR_BACKUP_FILE: /source/connector/${GOCHAT_CONNECTOR_BACKUP_NAME:-latest.db}
       GOCHAT_BACKUP_DIR: /backup/local
@@ -186,7 +188,7 @@ services:
     command: ["/backup/offsite/${GOCHAT_RESTORE_BUNDLE:-missing.tar.enc}"]
     restart: "no"
     environment:
-      GOCHAT_DATABASE_DSN: postgres://${POSTGRES_USER:-gochat}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-gochat_production}?sslmode=disable
+      GOCHAT_DATABASE_DSN: ${GOCHAT_DATABASE_DSN:?set an external PostgreSQL DSN with sslmode=verify-ca or verify-full}
       GOCHAT_STORAGE_PATH: /restore/storage/uploads
       GOCHAT_CONNECTOR_DB_PATH: /restore/connector/connector.db
       GOCHAT_BACKUP_PASSPHRASE_FILE: /run/secrets/backup-passphrase

deploy/docker/preflight_test.sh

@@ -31,7 +31,7 @@ chmod +x "$tmp/bin/findmnt" "$tmp/bin/docker"
 export PATH="$tmp/bin:$PATH"
 export GOCHAT_IMAGE_REF='gochat@example.invalid/gochat@sha256:0000000000000000000000000000000000000000000000000000000000000000'
 export SHANGWUTONG_IMAGE_REF='gochat@example.invalid/connector@sha256:1111111111111111111111111111111111111111111111111111111111111111'
-export GOCHAT_SERVER_CORS_ALLOWED_ORIGINS=https://chat.example.test
+export GOCHAT_SERVER_CORS_ALLOWED_ORIGINS=https://chat.ci.rogeecn.com
 export POSTGRES_PASSWORD=ci-postgres-secret
 export REDIS_PASSWORD=ci-redis-secret
 export MEILI_MASTER_KEY=ci-meili-secret-16