fix(security): harden infrastructure and CI (sec-infra-01..12)#46
Merged
Conversation
Implements 12 infrastructure hardening plans covering secrets,
containers, CI scanning, and dev environment defaults:
- sec-infra-01: remove hardcoded Lavalink 'youshallnotpass' default;
fail-fast in production if LAVALINK_PASSWORD unset
- sec-infra-02: migrate production secrets from env_file to Docker
secrets with *_FILE pattern; adds secret-files.ts resolver
- sec-infra-03: backup service uses .pgpass from Docker secret
instead of PGPASSWORD env var; backup.sh is fail-closed
- sec-infra-04: Dockerfile dev/test stages now run as node user
- sec-infra-05: parameterize dev postgres password with ${...:-fluxcore}
- sec-infra-06: BOT_SYNC_SECRET production fail-fast (unset or <32)
- sec-infra-07: Vite dev server defaults to 127.0.0.1; opt-in 0.0.0.0
via VITE_HOST env var
- sec-infra-08: add .github/workflows/security.yml (pnpm audit +
gitleaks + Trivy for bot/dashboard/filesystem) and .gitleaks.toml
- sec-infra-09: blank LAVALINK_PASSWORD in .env.example + CI guard
against reintroducing the hardcoded default
- sec-infra-10: parameterize pgAdmin credentials with fail-fast guard
- sec-infra-11: add docker-compose.no-db-port.yml override + CI guard
against public postgres exposure
- sec-infra-12: broaden .dockerignore and .gitignore to .env.* glob;
CI guard blocking tracked env files
New files: security.yml workflow, .gitleaks.toml, secret-files.ts,
docker-compose.no-db-port.yml, vite-config.test.ts, 3 config tests,
secrets/.gitkeep.
Typecheck clean. Dashboard 281 pass / 15 baseline failures (no new
regressions). Bot 325 pass / 16 baseline failures (no new regressions).
4 tasks
Member
Author
Abdulkhalek-1
added a commit
that referenced
this pull request
Jul 8, 2026
- turbo.json: add LAVALINK_HOST/PORT/PASSWORD to globalPassThroughEnv so turbo's strict envMode stops stripping the now-required LAVALINK_PASSWORD (#46) from the bot/dashboard dev processes. - docker-compose.yml: default PGADMIN_DEFAULT_PASSWORD to empty so `pnpm dev/stop` interpolate cleanly (Compose evaluates every service regardless of --profile); `--profile tools` still needs a real value. - docker-compose.override.yml: local dev override (CI=true + matched LAVALINK dev secret) so the services boot without a populated .env.dev. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements 12 infrastructure hardening plans covering secrets, containers, CI scanning, and dev environment defaults.
Breaking changes
Developers must set these env vars before `pnpm dev`:
Production deploy requires:
Changes
Note on packages/config tests
`packages/config` does not yet have a vitest runner wired up, so the 3 new config test files are written but not executed as part of `pnpm test`. They will run once a follow-up adds `vitest` as a devDep and a `test` script to the package.
Test plan
🤖 Generated with Claude Code