From c47b437b2273f31169adeef01080f3d019d29272 Mon Sep 17 00:00:00 2001 From: weichen Date: Sun, 20 Sep 2026 10:57:04 +0000 Subject: [PATCH] fix(ops): stop hardcoding DB passwords and URL-embed git tokens Load backup credentials from env/secrets files and push via a temporary credential helper so tokens never appear in process listings. Co-authored-by: Cursor --- .doc/ops/CURRENT.md | 8 ++--- scripts/backup-system-db.sh | 63 ++++++++++++++++++++++++++++++++++--- scripts/git-push-dev.sh | 25 +++++++++++++-- 3 files changed, 85 insertions(+), 11 deletions(-) diff --git a/.doc/ops/CURRENT.md b/.doc/ops/CURRENT.md index e3db3279..390a3344 100644 --- a/.doc/ops/CURRENT.md +++ b/.doc/ops/CURRENT.md @@ -17,8 +17,8 @@ | Cursor-Auto | 2026-09-20-p0-hotfixes（Wave 0 文档） | docs/p0-triage-2026-09-20 | - | docs | done | | Cursor-Auto | 2026-09-20-p0-capability-00058 | fix/capability-merge-00058-2026-09-20 | - | infra+chat | done | | Cursor-Auto | 2026-09-20-p0-idor | fix/authz-idor-hotfixes-2026-09-20 | - | authz | done | -| Cursor-Auto | 2026-09-20-p0-runtime-stability | fix/runtime-panic-races-2026-09-20 | - | taskrun+chat+web | in_progress | -| Cursor-Auto | 2026-09-20-p0-credentials | fix/credential-hardening-2026-09-20 | - | ops+infra | planned | +| Cursor-Auto | 2026-09-20-p0-runtime-stability | fix/runtime-panic-races-2026-09-20 | - | taskrun+chat+web | done | +| Cursor-Auto | 2026-09-20-p0-credentials | fix/credential-hardening-2026-09-20 | - | ops+infra | in_progress | | Cursor-Auto | 2026-09-20-proposed-authoritative-reports | feature/capability-enablement-impact-plan | - | docgov | done | | Cursor-Auto | 2026-09-20-pi-narrative-clipped-diff | feature/capability-enablement-impact-plan | - | docgov | done | | Cursor-Auto | 2026-09-20-pi-reasoning-profile | feature/capability-enablement-impact-plan | - | pi-agent | done | @@ -165,7 +165,7 @@ | holder | phase | since | scope | queue | |--------|-------|-------|-------|-------| -| Cursor-Auto | merging | 2026-09-20 | fix/runtime-panic-races | fix/credential-hardening | +| Cursor-Auto | merging | 2026-09-20 | fix/credential-hardening | - | **phase**: `idle` | `merging` | `smoke` | `e2e` @@ -177,7 +177,7 @@ |------|------|--------|------| | dev | 8080 | **58** | healthy（`chat_summaries` 已落地；`pi-agent`；events `:8088`） | | test | 8081 | **57** | healthy（含 triage `00057`；分支树最高仍可能为 56——晋升前须对齐；events `:8089`） | -| main | 8000 | **52** | healthy（分支树仅到 00025，环境超前——对齐晋升记 backlog；events `:8090`） | +| main | 8000 | **58** | healthy（P0 Wave3 rebuild 已追平 schema；分支树对齐仍记 backlog；口令已轮换；events `:8090`） | ## SSOT diff --git a/scripts/backup-system-db.sh b/scripts/backup-system-db.sh index 795753e0..618f0972 100755 --- a/scripts/backup-system-db.sh +++ b/scripts/backup-system-db.sh @@ -9,9 +9,16 @@ # # 用法: # ./scripts/backup-system-db.sh <目标备份目录> +# +# 口令（按优先级，不硬编码）: +# 1. 环境变量 SYSTEM_DB_PASSWORD +# 2. ${HOME}/.secrets/backup-env 中 SYSTEM_DB_PASSWORD_ +# 3. configs/.env. 中的 SYSTEM_DB_PASSWORD / CONTEXT_DB_PASSWORD +# 当前实现经 docker exec 以库内角色执行 pg_dump，通常不需要宿主机口令； +# 若后续改为宿主机 psql 连接，必须提供上述之一。 # ============================================================================= -set -eo pipefail +set -euo pipefail SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)" @@ -24,6 +31,9 @@ show_help() { 示例: $0 dev ./backups/system_dev_20260912 $0 test /tmp/agent_system_test_backup + +口令来源（勿写入仓库）: + SYSTEM_DB_PASSWORD 或 \${HOME}/.secrets/backup-env 或 configs/.env. EOF exit 0 } @@ -40,19 +50,22 @@ case "${ENV_NAME}" in CONTAINER_NAME="shuimu-context-pg-dev" DB_NAME="agent_system_dev" DB_USER="app" - DB_PASS="dev_secret_db_pass" + ENV_FILE="${ROOT_DIR}/configs/.env.dev" + SECRET_KEY="SYSTEM_DB_PASSWORD_DEV" ;; test) CONTAINER_NAME="shuimu-system-pg-test" DB_NAME="agent_system_test" DB_USER="app" - DB_PASS="test_secret_db_pass" + ENV_FILE="${ROOT_DIR}/configs/.env.test" + SECRET_KEY="SYSTEM_DB_PASSWORD_TEST" ;; main) CONTAINER_NAME="shuimu-system-pg-main" DB_NAME="agent_system_main" DB_USER="app" - DB_PASS="prod_highly_secure_db_pass" + ENV_FILE="${ROOT_DIR}/configs/.env.main" + SECRET_KEY="SYSTEM_DB_PASSWORD_MAIN" ;; *) echo "[错误] 未知环境: ${ENV_NAME}（仅支持 dev/test/main）" @@ -60,6 +73,48 @@ case "${ENV_NAME}" in ;; esac +resolve_db_password() { + if [[ -n "${SYSTEM_DB_PASSWORD:-}" ]]; then + printf '%s' "${SYSTEM_DB_PASSWORD}" + return 0 + fi + local secrets_file="${HOME}/.secrets/backup-env" + if [[ -f "${secrets_file}" ]]; then + local from_secret + from_secret=$(grep -E "^${SECRET_KEY}=" "${secrets_file}" | head -1 | cut -d= -f2- || true) + if [[ -n "${from_secret}" ]]; then + printf '%s' "${from_secret}" + return 0 + fi + from_secret=$(grep -E '^SYSTEM_DB_PASSWORD=' "${secrets_file}" | head -1 | cut -d= -f2- || true) + if [[ -n "${from_secret}" ]]; then + printf '%s' "${from_secret}" + return 0 + fi + fi + if [[ -f "${ENV_FILE}" ]]; then + local from_env + from_env=$(grep -E '^SYSTEM_DB_PASSWORD=' "${ENV_FILE}" | head -1 | cut -d= -f2- || true) + if [[ -z "${from_env}" ]]; then + from_env=$(grep -E '^CONTEXT_DB_PASSWORD=' "${ENV_FILE}" | head -1 | cut -d= -f2- || true) + fi + if [[ -n "${from_env}" ]]; then + printf '%s' "${from_env}" + return 0 + fi + fi + return 1 +} + +# docker exec 路径通常不需要宿主机口令；解析失败不阻断备份。 +DB_PASS="" +if resolved="$(resolve_db_password 2>/dev/null)" && [[ -n "${resolved}" ]]; then + DB_PASS="${resolved}" +fi +unset resolved +# 仅保留变量供未来宿主机连接扩展；当前 pg_dump 走容器内角色。 +: "${DB_PASS}" + mkdir -p "${TARGET_DIR}" TARGET_DIR="$(cd "${TARGET_DIR}" && pwd)" diff --git a/scripts/git-push-dev.sh b/scripts/git-push-dev.sh index 9c36bc68..f39dcc1f 100755 --- a/scripts/git-push-dev.sh +++ b/scripts/git-push-dev.sh @@ -1,6 +1,6 @@ #!/usr/bin/env bash -# 使用 ~/.secrets/gitea 推送 dev 分支（不写入 git config） -set -eo pipefail +# 使用 ~/.secrets/gitea 推送分支（不写入 git config；token 不出现在 URL/`ps`） +set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" SECRETS="${HOME}/.secrets/gitea" @@ -20,4 +20,23 @@ if [[ -z "${TOKEN}" || -z "${PREFIX}" ]]; then fi cd "${ROOT_DIR}" -git push "https://oauth2:${TOKEN}@${PREFIX}/weichen/Agent-System.git" "${BRANCH}" + +# 通过临时 credential helper 注入，避免 oauth2:token@host 出现在进程列表。 +HELPER_SCRIPT="$(mktemp)" +cleanup() { + rm -f "${HELPER_SCRIPT}" +} +trap cleanup EXIT + +cat > "${HELPER_SCRIPT}" <