fix(infra): refuse unsafe startup config, patch vulnerable dependencies #47

Merged

clement merged 1 commit from fix/infra-hardening into main

2026-10-18 15:41:15 +02:00

clement commented

2026-10-18 15:36:08 +02:00

Owner

Review item M10 (+ LOW Docker naming), reviewed independently and fixed.

⚠️ Before deploying: the backend now refuses to start with a JWT_SECRET shorter than 32 characters (or the .env.example placeholder). Check the secret on every instance (openssl rand -base64 48). Also in docs/RELEASE-NOTES-SECURITY-2026-10.md.

Startup

DATABASE_URL required outside GEARTRACK_DEV_MODE, and always for the admin CLI (no more silent in-memory database).
JWT_SECRET ≥ 32 characters, trimmed, not the placeholder, outside dev mode.
Dev mode (public JWT secret, permissive CORS) only binds to loopback.
Checks run before connecting to the database; rules in config.rs with unit tests, each refusal checked on the binary.

Dependencies

actix-web without default features: no HTTP/2 (behind Caddy over HTTP/1.1), drops vulnerable h2 0.3.
Rust: rustls 0.23.46, quinn-proto 0.11.19 (targeted updates). rsa ignored in .cargo/audit.toml (sqlx MySQL, public-key only, no fix).
Web: vitest 4.1, happy-dom 20, vue 3.5.44, postcss, nanoid, js-yaml, source-map-js, brace-expansion. Shipped deps other than vue unchanged (@tauri-apps/api, vuetify, vite, rollup…); dev tooling re-resolved. bun audit: 27 → 1 (braces, no fix, build-time i18n plugin, ignored).
cargo-audit 0.22.2 in devbox, task audit (Rust + web), green.

Infra / docs

Compose images named like task docker:* (DOCKER_HTTP_IMAGE, DOCKER_WEB_IMAGE, DOCKER_TAG).
.env.example no longer sets DATABASE_URL (it overrode the dev default and, through the Taskfile dotenv, reached the tests); documents deploying a pushed release without --build.
READMEs, task help.

Checks: clippy, vue-tsc, taplo, task audit; Rust 285 tests (also with a .env copied from the example), gear-client 39, gear-web 237; production web build.

🤖 Generated with Claude Code

Review item M10 (+ LOW Docker naming), reviewed independently and fixed. **⚠️ Before deploying**: the backend now refuses to start with a `JWT_SECRET` shorter than 32 characters (or the `.env.example` placeholder). Check the secret on every instance (`openssl rand -base64 48`). Also in `docs/RELEASE-NOTES-SECURITY-2026-10.md`. Startup - `DATABASE_URL` required outside `GEARTRACK_DEV_MODE`, and always for the admin CLI (no more silent in-memory database). - `JWT_SECRET` ≥ 32 characters, trimmed, not the placeholder, outside dev mode. - Dev mode (public JWT secret, permissive CORS) only binds to loopback. - Checks run before connecting to the database; rules in `config.rs` with unit tests, each refusal checked on the binary. Dependencies - `actix-web` without default features: no HTTP/2 (behind Caddy over HTTP/1.1), drops vulnerable `h2` 0.3. - Rust: `rustls` 0.23.46, `quinn-proto` 0.11.19 (targeted updates). `rsa` ignored in `.cargo/audit.toml` (sqlx MySQL, public-key only, no fix). - Web: `vitest` 4.1, `happy-dom` 20, `vue` 3.5.44, `postcss`, `nanoid`, `js-yaml`, `source-map-js`, `brace-expansion`. Shipped deps other than vue unchanged (`@tauri-apps/api`, `vuetify`, `vite`, `rollup`…); dev tooling re-resolved. `bun audit`: 27 → 1 (`braces`, no fix, build-time i18n plugin, ignored). - `cargo-audit` 0.22.2 in devbox, `task audit` (Rust + web), green. Infra / docs - Compose images named like `task docker:*` (`DOCKER_HTTP_IMAGE`, `DOCKER_WEB_IMAGE`, `DOCKER_TAG`). - `.env.example` no longer sets `DATABASE_URL` (it overrode the dev default and, through the Taskfile dotenv, reached the tests); documents deploying a pushed release without `--build`. - READMEs, `task help`. Checks: clippy, vue-tsc, taplo, `task audit`; Rust 285 tests (also with a `.env` copied from the example), gear-client 39, gear-web 237; production web build. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

clement added 1 commit

2026-10-18 15:36:08 +02:00

fix(infra): refuse unsafe startup config, patch vulnerable dependencies 4f7666172e

Startup:
- DATABASE_URL is required outside GEARTRACK_DEV_MODE, and always for
  the admin CLI: the silent fallback to an in-memory database lost every
  write and let `create-admin` succeed against an empty database.
- JWT_SECRET must be at least 32 characters (whitespace trimmed) and not
  the .env.example placeholder outside dev mode.
- Dev mode, which signs tokens with a public secret and allows any CORS
  origin, only binds to a loopback address.
- The checks run before connecting to the database; the rules live in
  config.rs with unit tests.

Dependencies:
- actix-web without default features (only `macros`): the backend never
  serves HTTP/2 (it sits behind Caddy over HTTP/1.1), which drops the
  vulnerable h2 0.3. Compression and cookies were unused.
- Rust: rustls 0.23.46 and quinn-proto 0.11.19. rsa (RUSTSEC-2023-0071)
  is ignored in .cargo/audit.toml: it only reaches us through sqlx's
  MySQL driver, which only encrypts with a public key, and has no fix.
- Web: vitest 4.1 and happy-dom 20 (critical advisories in the test
  tooling), vue 3.5.44, postcss, nanoid, js-yaml, source-map-js and
  brace-expansion. Re-resolving the workspace manifests also moved dev
  tooling (eslint, types); shipped dependencies other than vue keep their
  versions. bun audit: 27 vulnerabilities down to 1 (braces, no fix,
  build-time i18n plugin only).
- cargo-audit 0.22.2 in devbox.

Infra and docs:
- docker-compose names its images like `task docker:*`
  (DOCKER_HTTP_IMAGE, DOCKER_WEB_IMAGE, DOCKER_TAG, default tag `local`),
  so pushed images are the ones compose runs.
- `task audit` / `audit:rust` / `audit:web`, listed in `task help`; the
  braces advisory is ignored explicitly.
- .env.example no longer sets DATABASE_URL: the value overrode the
  dev:backend default and, loaded by the Taskfile, reached the tests.
  It documents how to deploy a pushed release without rebuilding.
- READMEs describe the startup checks and the audit task.