[P1] Move secrets out of docker-compose.yml (JWT_SECRET, ADMIN_PASSWORD, POSTGRES_PASSWORD) #97

New issue

Open

opened 2026-07-07 16:21:57 +12:00 by fastie81 · 1 comment

fastie81 commented

2026-07-07 16:21:57 +12:00

Owner

Problem

docker-compose.yml contains hardcoded secrets:

Line 22: JWT_SECRET=${JWT_SECRET:-fallback_secret_for_dev_only}
Line 19: ADMIN_PASSWORD=${ADMIN_PASSWORD:-AdminPassword123}
Line 40: POSTGRES_PASSWORD=postgres

Expected Behavior

Use Docker secrets or external .env file:

# docker-compose.yml
environment:
  - JWT_SECRET_FILE=/run/secrets/jwt_secret
  - ADMIN_PASSWORD_FILE=/run/secrets/admin_password

secrets:
  jwt_secret:
    file: ./secrets/jwt_secret.txt
  admin_password:
    file: ./secrets/admin_password.txt

Or at minimum, require all secrets via .env with no defaults.

docker-compose.yml (lines 16-22, 39-41)
Need: .env template without defaults for secrets

### Problem `docker-compose.yml` contains hardcoded secrets: - Line 22: `JWT_SECRET=${JWT_SECRET:-fallback_secret_for_dev_only}` - Line 19: `ADMIN_PASSWORD=${ADMIN_PASSWORD:-AdminPassword123}` - Line 40: `POSTGRES_PASSWORD=postgres` ### Expected Behavior Use Docker secrets or external `.env` file: ```yaml # docker-compose.yml environment: - JWT_SECRET_FILE=/run/secrets/jwt_secret - ADMIN_PASSWORD_FILE=/run/secrets/admin_password secrets: jwt_secret: file: ./secrets/jwt_secret.txt admin_password: file: ./secrets/admin_password.txt ``` Or at minimum, require all secrets via `.env` with no defaults. ### Related Files - `docker-compose.yml` (lines 16-22, 39-41) - Need: `.env` template without defaults for secrets

fastie81 added the

labels

2026-07-07 16:21:57 +12:00

fastie81 referenced this issue from a commit

2026-09-14 11:24:07 +12:00

fix(security): remove hardcoded secrets, add coverage gate, tighten dockerignore

fastie81 referenced this issue from a pull request that will close it,

2026-09-14 11:24:10 +12:00

fix(security): remove hardcoded secrets, add coverage gate, tighten dockerignore #142

fastie81 closed this issue

2026-10-21 18:43:53 +13:00

fastie81 commented

2026-10-21 18:44:05 +13:00

Author

Owner

Merged #142 (main). Partial only: removes the insecure :- fallbacks in docker-compose.yml (now :? fail-fast) and adds POSTGRES_PASSWORD to env files. The weak values are still committed in .env.prod/.env.test (ADMIN_PASSWORD, JWT_SECRET=fallback_secret_for_dev_only, POSTGRES_PASSWORD=postgres), and prod uses them via the CI scp. Real fix still to do: Action secrets + {{PLACEHOLDER}} sed injection into .env.prod, then rotate (JWT rotation logs everyone out). Keeping open. Live in prod only after the next v* tag.

Merged #142 (main). Partial only: removes the insecure `:-` fallbacks in `docker-compose.yml` (now `:?` fail-fast) and adds `POSTGRES_PASSWORD` to env files. **The weak values are still committed** in `.env.prod`/`.env.test` (`ADMIN_PASSWORD`, `JWT_SECRET=fallback_secret_for_dev_only`, `POSTGRES_PASSWORD=postgres`), and prod uses them via the CI scp. Real fix still to do: Action secrets + `{{PLACEHOLDER}}` sed injection into `.env.prod`, then rotate (JWT rotation logs everyone out). Keeping open. Live in prod only after the next `v*` tag.

fastie81 reopened this issue

2026-10-21 19:11:57 +13:00