3 Commits

Author	SHA1	Message	Date
admin	e467785fd3	security: rotate the published secrets and de-git felhom.secret.yaml (R-925, P1) ... WHY .gitignore "was not working": it was working. git never consults .gitignore for a file it ALREADY TRACKS. The rule `*secret*` matched fine -- proved by dropping an untracked copy in and watching check-ignore name `.gitignore:3:*secret*`. The file had been tracked since feea0606, which is ironically the commit that de-gitted the Resend key. WHAT THE EXPOSED VALUE ACTUALLY WAS. Not an analytics password: the GITEA ADMIN ACCOUNT PASSWORD (is_admin true; /api/v1/admin/users answered 200), in a repo gitea.dooplex.hu serves anonymously to the internet. That is push access to every repo -- including the one whose website/ is git-synced live and whose scripts/ is published by tag to every new box installer (R-110). Re-ranked P2 -> P1 on that measurement; my first ranking had only measured the analytics blast radius. Every committed value was still live. Nothing had ever been rotated. ROTATED (values never echoed; written to a 0600 file on DooPlex): umami-config APP_SECRET + POSTGRES_PASSWORD. The password was changed INSIDE postgres (ALTER USER) as well as in the Secret -- the env var is only read at first init, so patching the Secret alone would have changed nothing. healthchecks-config SECRET_KEY + SUPERUSER_PASSWORD (nothing consumes them, there is no healthchecks Deployment). gitea-creds no longer holds the admin password at all: a SCOPED token (read:package + read:repository). gitea admin new random password; gitea-system/gitea-admin updated. VERIFIED, not assumed: - new admin password -> 200, OLD PUBLISHED PASSWORD -> 401 (the leak is dead) - umami: a real beacon returns 200 (so the app authenticates to postgres and writes) while a bogus site id still returns 400 (so the 200 means something) - hub: "Registry version check: latest = 0.304.0" AND "Template fetched (5881 bytes)", no auth failures - BOTH token scopes are load-bearing, and the second was found by breaking it: a package-only token made the hub log "Template fetch: unexpected status 403", because the template fetcher reads a raw file out of the felhom-controller repo, not the registry. AN INCIDENT CAUSED BY THE FIX, recorded because it is the useful part: the rollout restart needed to pick up the new umami secret put umami into CrashLoopBackOff and took stats.felhom.eu down (503) for ~4 minutes. Not the rotation -- at memory 512Mi that pod runs for months but CANNOT RESTART: startup (Prisma + Next.js) peaks over the limit and is OOMKilled (exit 137). Raised to 1Gi IN THE MANIFEST, not just live, per .claude/rules/manifests.md ("never bare kubectl set -- the next sync reverts it and the fix silently disappears"). THE GATE: KNOWN_BACKLOG is removed from manifest_bearer_gate.py, as its own comment instructed. Red-proofed with a decoy: exit 1 with it, exit 0 without. An exemption kept this visible for three months and changed nothing. WHAT REMAINS (operator, and it is bigger than what was fixed): the same password is still the admin password in ~12 other namespaces -- nextcloud, paperless, bookstack (a DATABASE ROOT password), tandoor, calibre, adventurelog, gokapi, qbittorrent, servarr, homepage. Rotating Gitea does not touch them. Also owed: a kisfenyo Gitea token sits in plaintext in the local homelab-manifests remote URL and was printed to a session transcript during this investigation, so it should be replaced regardless (R-580's shape). NOT a finding: homelab-manifests is private (404 anonymously) and does not contain the password; ArgoCD's repo credential is a separate token and was untouched by the rotation.	2026-10-09 13:21:18 +02:00
admin	574f5df107	the decoy sweep: 29 gates read, 16 fooled, 10 fixed - and a gate that refuses the next one (R-421) ... THE CLASS, now a row: an instrument that matches a LABEL rather than the fact it names. Five instances - R-410, R-400, R-378, R-419, R-94 - and EVERY ONE was found by accident, by someone looking at something else. The gates enforce every other rule in this project, including the rule that findings must be written down rather than left in prose. Nothing had ever checked the gates. METHOD, and it is the transferable part: for each gate, construct the label WITHOUT the fact - a directory with the right name and no bake log, a handler case that exists only in a comment, a note whose prose mentions the marker it lacks - run the gate, record what it says. No verdict was reached by reading. Reading is how all five hid. RESULT: 29 distinct scripts (35 registrations; three are shared across three runners). 19 sound, 4 holes left OPEN with rows, 6 that no plausible decoy could be built for and are named UNTESTED rather than called sound. A gate nobody tried to fool is UNKNOWN. SCOPE IS A FACT TOO - the largest single cause, and mundane. Eight gates decided what to look at with os.listdir, one level. Every one was green AND CORRECT today, and every one would have gone blind the moment anyone added a subdirectory. mojibake and docker-v already used os.walk, caught the identical planted file, and are the control that proves the cause was the listing and not the decoy. IN THIS REPO: hub-confirm and manifest-bearer now walk. observations_gate (R-419, CLOSED) requires a marker at a line start or after a sentence boundary and strips inline code spans - a note SAYING it carries no marker no longer satisfies the marker test. closed-register now CONVICTS on a row it cannot parse instead of warning: FOUR rows were in that state, TWO of them written by the session that closed them the day before, and every one was exempt from the only check that reads that file. The rows were repaired first and the conviction added second - registering a failing gate refuses every push. THE META-GATE: decoy_coverage_gate.py refuses a gate registered without a decoy or a named exemption. It convicted ITSELF the moment it was registered, which is how it came to have one. Coverage is a DECLARATION the gate AST-parses, never a grep - searching a test file for a gate's name would be the very shape this sweep exists to find. The 20 uncovered gates are listed by name (R-426). NOT FIXED, each with a row and a decoy asserting TODAY's behaviour so the fix must be deliberate: R-422 reuse-refs (only 7 extensions; a rotted .md citation is invisible), R-423 site (PAGES is a hardcoded list of 7), R-424 one-register (a defect parked as `idea`), R-425 offbox-rename (fixed FILES list). R-427: closed_register_gate checks ONE direction - twelve open rows carry a closed verdict and were NOT moved, because telling finished from partly-finished is a judgement and R-378 is the record of a machine getting it wrong. FIVE DECOYS WITHDRAWN AS ILLEGITIMATE, mine, named in the audit. A decoy nobody would write proves nothing, and manufacturing a finding to fill a row is worse than an honest NO. No product code. No version bump. No image. No golden owed. All four runners green. Register: OPEN 172 -> 178, CLOSED 160 -> 161.	2026-09-01 12:39:45 +02:00
admin	3682303131	scripts: manifest bearer gate lands as manifest_bearer_gate.py (the .gitignore *secret* pattern silently un-tracks any 'secret'-named gate file - the previous commit's gate never made it into git); references updated	2026-07-13 14:59:31 +02:00