Trey t
c77ff07ce9
Remediation of the 2026-05-12/13 audits (78 findings + cluster gaps), tracked in deploy-k3s/SECURITY.md, plus fixes from two independent post-remediation reviews. Auth & sessions: - SHA-256 hashed auth-token storage (C1); prior-token cache eviction on re-login (MEDIUM-1) - local Google JWKS verification, iss/aud/exp checks (C2/C3) - constant-time login + generic errors (L1/LIVE-L11/LIVE-L13) - per-account login lockout keyed on distinct source IPs (M5/MEDIUM-3) - verified-email gating, login rate limiting (LIVE-L19, H1-H3) IAP & webhooks: - Apple/Google cross-account replay protection (C5/C6/C10/C13, H5/H6) - migrations 000003-000006 (token hashing, IAP replay, audit_log + webhook_event_log table creation, append-only audit log) Authorization & races: - file-ownership owner-OR-member fix (C7), atomic share-code join (C9/H9), device-token reassignment (C8/LOW-3) Secrets & deploy: - secrets file-mounted at /etc/honeydue/secrets, not env (F8); Redis password out of the ConfigMap (HIGH-1); B2 keys reconciled - digest-pinned images, admin ingress hardening, CSP/HSTS, /metrics lockdown; kubeconfig 0600, etcd secrets-encryption, fail2ban + unattended-upgrades at provision; secret-rotation runbook Build, vet, and the full test suite (incl. -race) pass; the goose migration chain is verified against PostgreSQL 16. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
98 lines
3.2 KiB
YAML
98 lines
3.2 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: worker
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/name: worker
|
|
app.kubernetes.io/part-of: honeydue
|
|
spec:
|
|
# Asynq's Scheduler is a singleton — running >1 replica fires every cron
|
|
# task once per replica (duplicate daily digests, onboarding emails, etc.).
|
|
# Keep at 1 until asynq.PeriodicTaskManager with Redis leader election is
|
|
# wired in cmd/worker/main.go.
|
|
replicas: 1
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 0
|
|
maxSurge: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: worker
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: worker
|
|
app.kubernetes.io/part-of: honeydue
|
|
spec:
|
|
serviceAccountName: worker
|
|
# Explicit pod-level opt-out (audit F11) — defense-in-depth on top of
|
|
# the ServiceAccount-level setting in rbac.yaml.
|
|
automountServiceAccountToken: false
|
|
imagePullSecrets:
|
|
- name: gitea-credentials
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: worker
|
|
image: IMAGE_PLACEHOLDER # Replaced by 03-deploy.sh
|
|
imagePullPolicy: IfNotPresent # audit CODE-L4 — explicit; images are SHA/digest-pinned
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
envFrom:
|
|
- configMapRef:
|
|
name: honeydue-config
|
|
# Audit CODE-F8: secrets are NOT injected as environment variables.
|
|
# Env vars are readable for the life of the pod via /proc/<pid>/environ
|
|
# and leak into crash dumps / child processes. honeydue-secrets is
|
|
# mounted read-only at /etc/honeydue/secrets (mode 0400) and the Go
|
|
# config layer (config.loadFileSecrets) reads each key from its file.
|
|
# Non-secret config still arrives via the configMapRef above.
|
|
volumeMounts:
|
|
- name: app-secrets
|
|
mountPath: /etc/honeydue/secrets
|
|
readOnly: true
|
|
- name: apns-key
|
|
mountPath: /secrets/apns
|
|
readOnly: true
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
livenessProbe:
|
|
exec:
|
|
command: ["pgrep", "-f", "/app/worker"]
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
volumes:
|
|
# Audit CODE-F8: the whole honeydue-secrets Secret, projected as files.
|
|
# defaultMode 0400 → readable only by the container's runAsUser (1000).
|
|
- name: app-secrets
|
|
secret:
|
|
secretName: honeydue-secrets
|
|
defaultMode: 0400
|
|
- name: apns-key
|
|
secret:
|
|
secretName: honeydue-apns-key
|
|
items:
|
|
- key: apns_auth_key.p8
|
|
path: apns_auth_key.p8
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 64Mi
|