fix(security): remove hardcoded secrets, add coverage gate, tighten dockerignore #142

Merged

fastie81 merged 1 commit from fix/easy-issues-secrets-dockerignore into main

2026-10-21 18:43:52 +13:00

fastie81 commented

2026-09-14 11:24:10 +12:00

Owner

Easy-win batch from open-issue triage

[#97] Move secrets out of docker-compose.yml (P1, security)

docker-compose.yml: replaced insecure fallback defaults (ADMIN_PASSWORD:-AdminPassword123, JWT_SECRET:-fallback_secret_for_dev_only, hardcoded POSTGRES_PASSWORD=postgres) with fail-fast :? interpolation — compose now fails loudly if a secret is missing instead of booting with a known default.
Added POSTGRES_PASSWORD to .env.test, .env.prod, .env.example (value matches the existing DATABASE_URL credential).
Test/prod already inject secrets via env_file + CI sed placeholders, so this only removes the insecure defaults, no new secret files needed.
Dev stack (honbu-manager-dev on :5003) keeps its own dev-only values — untouched.

[#100] Enforce minimum test coverage in CI (P2)

Added --cov-fail-under=60 to the CI pytest step.
Baseline measured live (dev instance, 401 passing): 64% total. Gate set at 60% to catch regression without being red on day one.
Corrected stale README badge (claimed 80% → actual 64%).

[#92] Tighten .dockerignore (P0)

Root .dockerignore already covered the core asks; added recursive **/node_modules, **/.vite, **/dist, **/.env*, .DS_Store.

Testing

Dev instance stood up at 192.168.10.52:5003 (honbu-manager-dev, own Postgres volume, debug mode) — test (:5000) and prod (Unraid) untouched.
Compose config validated on the target host: OK with secrets present.
Backend suite run in dev container: 401 passed, 64% coverage.

Not touched (larger/feature work)

#89, #90, #94, #95, #99, #101/67, #102, #103/26, #104/25 — out of scope for this easy-win batch.

Closes #97, #92, #100

## Easy-win batch from open-issue triage ### [#97] Move secrets out of docker-compose.yml (P1, security) - `docker-compose.yml`: replaced insecure fallback defaults (`ADMIN_PASSWORD:-AdminPassword123`, `JWT_SECRET:-fallback_secret_for_dev_only`, hardcoded `POSTGRES_PASSWORD=postgres`) with fail-fast `:?` interpolation — compose now fails loudly if a secret is missing instead of booting with a known default. - Added `POSTGRES_PASSWORD` to `.env.test`, `.env.prod`, `.env.example` (value matches the existing `DATABASE_URL` credential). - Test/prod already inject secrets via `env_file` + CI `sed` placeholders, so this only removes the insecure defaults, no new secret files needed. - Dev stack (`honbu-manager-dev` on :5003) keeps its own dev-only values — untouched. ### [#100] Enforce minimum test coverage in CI (P2) - Added `--cov-fail-under=60` to the CI pytest step. - Baseline measured live (dev instance, 401 passing): **64%** total. Gate set at 60% to catch regression without being red on day one. - Corrected stale README badge (claimed 80% → actual 64%). ### [#92] Tighten .dockerignore (P0) - Root `.dockerignore` already covered the core asks; added recursive `**/node_modules`, `**/.vite`, `**/dist`, `**/.env*`, `.DS_Store`. ## Testing - Dev instance stood up at `192.168.10.52:5003` (`honbu-manager-dev`, own Postgres volume, debug mode) — test (:5000) and prod (Unraid) untouched. - Compose config validated on the target host: OK with secrets present. - Backend suite run in dev container: **401 passed, 64% coverage**. ## Not touched (larger/feature work) #89, #90, #94, #95, #99, #101/67, #102, #103/26, #104/25 — out of scope for this easy-win batch. Closes #97, #92, #100

fastie81 self-assigned this

2026-09-14 11:24:10 +12:00

fastie81 added 1 commit

2026-09-14 11:24:11 +12:00

fix(security): remove hardcoded secrets, add coverage gate, tighten dockerignore

CI / test (push) Successful in 2m28s

Details

CI / lint-frontend (push) Successful in 1m8s

Details

CI / build (push) Has been skipped

Details

CI / deploy (push) Has been skipped

Details

01d14cfbde

Closes #97: require JWT_SECRET/ADMIN_PASSWORD/POSTGRES_PASSWORD via .env
  with fail-fast :? interpolation (no insecure fallbacks in compose).
Closes #100: enforce min 60% backend coverage in Forgejo CI pytest step.
Closes #92: tighten root .dockerignore w/ recursive node_modules/dist/.env
  and .DS_Store. Fix stale README coverage badge (80%->64% measured).