mirror of
https://gitee.com/pnoker/iot-dc3.git
synced 2026-11-01 18:51:53 +08:00
pnoker
2d565f4a2d
the historical defaults dc3.security.key.2026.io.github.pnoker and
io.github.pnoker.dc3 are public in this repository, so any deployment
that never overrode them shipped a known hmac signing key
- app/scale/swarm compose: fail fast (${var:?}) when dc3_security_key
or auth_hmac_secret is unset; dev compose keeps a clearly-marked
dev-only default
- helm production/default values and k8s secret.env ship empty values:
pre/pro startup rejects blank and known-default hmac keys, forcing
--set-string or an existingsecret; document the per-key failure mode
honestly instead of overpromising startup rejection for both
- dev env files: rotate both keys to machine-generated dev-only values
and add throwaway rs256 material for local oauth flows
- fix the chart maintainer email to a syntactically valid address
18 lines
786 B
Bash
18 lines
786 B
Bash
# kustomize secretGenerator input -> Secret "dc3-secrets".
|
|
# DEFAULTS BELOW ARE PUBLIC WEAK VALUES - COPY THIS FILE TO secret.env, EDIT
|
|
# THEM, AND NEVER COMMIT REAL SECRETS. Production must use strong random
|
|
# values for DC3_SECURITY_KEY / AUTH_HMAC_SECRET / passwords (see
|
|
# dc3/doc/DEPLOYMENT.md "Production hardening").
|
|
POSTGRES_USERNAME=dc3
|
|
POSTGRES_PASSWORD=*********
|
|
RABBITMQ_USERNAME=dc3
|
|
RABBITMQ_PASSWORD=*********
|
|
MQTT_USERNAME=dc3
|
|
MQTT_PASSWORD=*********
|
|
DC3_SECURITY_KEY=dc3.security.key.2026.io.github.pnoker
|
|
# REQUIRED in pre/pro: set a deployment-specific value, e.g. `openssl rand -hex 32`.
|
|
# Blank disables principal signing in dev/test only; pre/pro startup rejects blank
|
|
# and rejects the historical public default.
|
|
AUTH_HMAC_SECRET=
|
|
AGENTIC_FALLBACK_OPENAI_API_KEY=
|