Trey t
c77ff07ce9
Remediation of the 2026-05-12/13 audits (78 findings + cluster gaps), tracked in deploy-k3s/SECURITY.md, plus fixes from two independent post-remediation reviews. Auth & sessions: - SHA-256 hashed auth-token storage (C1); prior-token cache eviction on re-login (MEDIUM-1) - local Google JWKS verification, iss/aud/exp checks (C2/C3) - constant-time login + generic errors (L1/LIVE-L11/LIVE-L13) - per-account login lockout keyed on distinct source IPs (M5/MEDIUM-3) - verified-email gating, login rate limiting (LIVE-L19, H1-H3) IAP & webhooks: - Apple/Google cross-account replay protection (C5/C6/C10/C13, H5/H6) - migrations 000003-000006 (token hashing, IAP replay, audit_log + webhook_event_log table creation, append-only audit log) Authorization & races: - file-ownership owner-OR-member fix (C7), atomic share-code join (C9/H9), device-token reassignment (C8/LOW-3) Secrets & deploy: - secrets file-mounted at /etc/honeydue/secrets, not env (F8); Redis password out of the ConfigMap (HIGH-1); B2 keys reconciled - digest-pinned images, admin ingress hardening, CSP/HSTS, /metrics lockdown; kubeconfig 0600, etcd secrets-encryption, fail2ban + unattended-upgrades at provision; secret-rotation runbook Build, vet, and the full test suite (incl. -race) pass; the goose migration chain is verified against PostgreSQL 16. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
112 lines
3.3 KiB
YAML
112 lines
3.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: web
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/name: web
|
|
app.kubernetes.io/part-of: honeydue
|
|
spec:
|
|
replicas: 3
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 0
|
|
maxSurge: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: web
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: web
|
|
app.kubernetes.io/part-of: honeydue
|
|
spec:
|
|
serviceAccountName: web
|
|
# Explicit pod-level opt-out (audit F11) — defense-in-depth on top of
|
|
# the ServiceAccount-level setting in rbac.yaml.
|
|
automountServiceAccountToken: false
|
|
imagePullSecrets:
|
|
- name: gitea-credentials
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
# Spread pods across nodes so one node loss drops at most one replica.
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: ScheduleAnyway
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: web
|
|
containers:
|
|
- name: web
|
|
image: IMAGE_PLACEHOLDER # Replaced by 03-deploy.sh or manual sed
|
|
imagePullPolicy: IfNotPresent # audit CODE-L4 — explicit; images are SHA/digest-pinned
|
|
ports:
|
|
- containerPort: 3000
|
|
protocol: TCP
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
env:
|
|
- name: PORT
|
|
value: "3000"
|
|
- name: HOSTNAME
|
|
value: "0.0.0.0"
|
|
# Server-side proxy target (src/app/api/proxy/[...path]/route.ts,
|
|
# src/app/api/auth/*/route.ts). Browser never sees this URL.
|
|
- name: API_URL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: honeydue-config
|
|
key: API_URL
|
|
volumeMounts:
|
|
# Next.js writes its build cache here; readOnlyRootFilesystem blocks
|
|
# writing to /app/.next/cache otherwise.
|
|
- name: nextjs-cache
|
|
mountPath: /app/.next/cache
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 256Mi
|
|
# Next.js standalone serves at `/`. `/login` also 200s pre-auth.
|
|
startupProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
failureThreshold: 24
|
|
periodSeconds: 5
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
volumes:
|
|
- name: nextjs-cache
|
|
emptyDir:
|
|
sizeLimit: 256Mi
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 64Mi
|