fix(ops): stop hardcoding DB passwords and URL-embed git tokens
Load backup credentials from env/secrets files and push via a temporary credential helper so tokens never appear in process listings. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
weichen
+4
-4
@@ -17,8 +17,8 @@
|
||||
| Cursor-Auto | 2026-09-20-p0-hotfixes（Wave 0 文档） | docs/p0-triage-2026-09-20 | - | docs | done |
|
||||
| Cursor-Auto | 2026-09-20-p0-capability-00058 | fix/capability-merge-00058-2026-09-20 | - | infra+chat | done |
|
||||
| Cursor-Auto | 2026-09-20-p0-idor | fix/authz-idor-hotfixes-2026-09-20 | - | authz | done |
|
||||
| Cursor-Auto | 2026-09-20-p0-runtime-stability | fix/runtime-panic-races-2026-09-20 | - | taskrun+chat+web | in_progress |
|
||||
| Cursor-Auto | 2026-09-20-p0-credentials | fix/credential-hardening-2026-09-20 | - | ops+infra | planned |
|
||||
| Cursor-Auto | 2026-09-20-p0-runtime-stability | fix/runtime-panic-races-2026-09-20 | - | taskrun+chat+web | done |
|
||||
| Cursor-Auto | 2026-09-20-p0-credentials | fix/credential-hardening-2026-09-20 | - | ops+infra | in_progress |
|
||||
| Cursor-Auto | 2026-09-20-proposed-authoritative-reports | feature/capability-enablement-impact-plan | - | docgov | done |
|
||||
| Cursor-Auto | 2026-09-20-pi-narrative-clipped-diff | feature/capability-enablement-impact-plan | - | docgov | done |
|
||||
| Cursor-Auto | 2026-09-20-pi-reasoning-profile | feature/capability-enablement-impact-plan | - | pi-agent | done |
|
||||
@@ -165,7 +165,7 @@
|
||||
|
||||
| holder | phase | since | scope | queue |
|
||||
|--------|-------|-------|-------|-------|
|
||||
| Cursor-Auto | merging | 2026-09-20 | fix/runtime-panic-races | fix/credential-hardening |
|
||||
| Cursor-Auto | merging | 2026-09-20 | fix/credential-hardening | - |
|
||||
|
||||
**phase**: `idle` | `merging` | `smoke` | `e2e`
|
||||
|
||||
@@ -177,7 +177,7 @@
|
||||
|------|------|--------|------|
|
||||
| dev | 8080 | **58** | healthy（`chat_summaries` 已落地；`pi-agent`；events `:8088`） |
|
||||
| test | 8081 | **57** | healthy（含 triage `00057`；分支树最高仍可能为 56——晋升前须对齐；events `:8089`） |
|
||||
| main | 8000 | **52** | healthy（分支树仅到 00025，环境超前——对齐晋升记 backlog；events `:8090`） |
|
||||
| main | 8000 | **58** | healthy（P0 Wave3 rebuild 已追平 schema；分支树对齐仍记 backlog；口令已轮换；events `:8090`） |
|
||||
|
||||
## SSOT
|
||||
|
||||
|
||||
@@ -9,9 +9,16 @@
|
||||
#
|
||||
# 用法:
|
||||
# ./scripts/backup-system-db.sh <dev|test|main> <目标备份目录>
|
||||
#
|
||||
# 口令（按优先级，不硬编码）:
|
||||
# 1. 环境变量 SYSTEM_DB_PASSWORD
|
||||
# 2. ${HOME}/.secrets/backup-env 中 SYSTEM_DB_PASSWORD_<ENV>
|
||||
# 3. configs/.env.<env> 中的 SYSTEM_DB_PASSWORD / CONTEXT_DB_PASSWORD
|
||||
# 当前实现经 docker exec 以库内角色执行 pg_dump，通常不需要宿主机口令；
|
||||
# 若后续改为宿主机 psql 连接，必须提供上述之一。
|
||||
# =============================================================================
|
||||
|
||||
set -eo pipefail
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
||||
@@ -24,6 +31,9 @@ show_help() {
|
||||
示例:
|
||||
$0 dev ./backups/system_dev_20260912
|
||||
$0 test /tmp/agent_system_test_backup
|
||||
|
||||
口令来源（勿写入仓库）:
|
||||
SYSTEM_DB_PASSWORD 或 \${HOME}/.secrets/backup-env 或 configs/.env.<env>
|
||||
EOF
|
||||
exit 0
|
||||
}
|
||||
@@ -40,19 +50,22 @@ case "${ENV_NAME}" in
|
||||
CONTAINER_NAME="shuimu-context-pg-dev"
|
||||
DB_NAME="agent_system_dev"
|
||||
DB_USER="app"
|
||||
DB_PASS="dev_secret_db_pass"
|
||||
ENV_FILE="${ROOT_DIR}/configs/.env.dev"
|
||||
SECRET_KEY="SYSTEM_DB_PASSWORD_DEV"
|
||||
;;
|
||||
test)
|
||||
CONTAINER_NAME="shuimu-system-pg-test"
|
||||
DB_NAME="agent_system_test"
|
||||
DB_USER="app"
|
||||
DB_PASS="test_secret_db_pass"
|
||||
ENV_FILE="${ROOT_DIR}/configs/.env.test"
|
||||
SECRET_KEY="SYSTEM_DB_PASSWORD_TEST"
|
||||
;;
|
||||
main)
|
||||
CONTAINER_NAME="shuimu-system-pg-main"
|
||||
DB_NAME="agent_system_main"
|
||||
DB_USER="app"
|
||||
DB_PASS="prod_highly_secure_db_pass"
|
||||
ENV_FILE="${ROOT_DIR}/configs/.env.main"
|
||||
SECRET_KEY="SYSTEM_DB_PASSWORD_MAIN"
|
||||
;;
|
||||
*)
|
||||
echo "[错误] 未知环境: ${ENV_NAME}（仅支持 dev/test/main）"
|
||||
@@ -60,6 +73,48 @@ case "${ENV_NAME}" in
|
||||
;;
|
||||
esac
|
||||
|
||||
resolve_db_password() {
|
||||
if [[ -n "${SYSTEM_DB_PASSWORD:-}" ]]; then
|
||||
printf '%s' "${SYSTEM_DB_PASSWORD}"
|
||||
return 0
|
||||
fi
|
||||
local secrets_file="${HOME}/.secrets/backup-env"
|
||||
if [[ -f "${secrets_file}" ]]; then
|
||||
local from_secret
|
||||
from_secret=$(grep -E "^${SECRET_KEY}=" "${secrets_file}" | head -1 | cut -d= -f2- || true)
|
||||
if [[ -n "${from_secret}" ]]; then
|
||||
printf '%s' "${from_secret}"
|
||||
return 0
|
||||
fi
|
||||
from_secret=$(grep -E '^SYSTEM_DB_PASSWORD=' "${secrets_file}" | head -1 | cut -d= -f2- || true)
|
||||
if [[ -n "${from_secret}" ]]; then
|
||||
printf '%s' "${from_secret}"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
if [[ -f "${ENV_FILE}" ]]; then
|
||||
local from_env
|
||||
from_env=$(grep -E '^SYSTEM_DB_PASSWORD=' "${ENV_FILE}" | head -1 | cut -d= -f2- || true)
|
||||
if [[ -z "${from_env}" ]]; then
|
||||
from_env=$(grep -E '^CONTEXT_DB_PASSWORD=' "${ENV_FILE}" | head -1 | cut -d= -f2- || true)
|
||||
fi
|
||||
if [[ -n "${from_env}" ]]; then
|
||||
printf '%s' "${from_env}"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
|
||||
# docker exec 路径通常不需要宿主机口令；解析失败不阻断备份。
|
||||
DB_PASS=""
|
||||
if resolved="$(resolve_db_password 2>/dev/null)" && [[ -n "${resolved}" ]]; then
|
||||
DB_PASS="${resolved}"
|
||||
fi
|
||||
unset resolved
|
||||
# 仅保留变量供未来宿主机连接扩展；当前 pg_dump 走容器内角色。
|
||||
: "${DB_PASS}"
|
||||
|
||||
mkdir -p "${TARGET_DIR}"
|
||||
TARGET_DIR="$(cd "${TARGET_DIR}" && pwd)"
|
||||
|
||||
|
||||
+22
-3
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env bash
|
||||
# 使用 ~/.secrets/gitea 推送 dev 分支（不写入 git config）
|
||||
set -eo pipefail
|
||||
# 使用 ~/.secrets/gitea 推送分支（不写入 git config；token 不出现在 URL/`ps`）
|
||||
set -euo pipefail
|
||||
|
||||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
SECRETS="${HOME}/.secrets/gitea"
|
||||
@@ -20,4 +20,23 @@ if [[ -z "${TOKEN}" || -z "${PREFIX}" ]]; then
|
||||
fi
|
||||
|
||||
cd "${ROOT_DIR}"
|
||||
git push "https://oauth2:${TOKEN}@${PREFIX}/weichen/Agent-System.git" "${BRANCH}"
|
||||
|
||||
# 通过临时 credential helper 注入，避免 oauth2:token@host 出现在进程列表。
|
||||
HELPER_SCRIPT="$(mktemp)"
|
||||
cleanup() {
|
||||
rm -f "${HELPER_SCRIPT}"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
cat > "${HELPER_SCRIPT}" <<EOF
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
if [[ "\${1:-}" == "get" ]]; then
|
||||
echo "username=oauth2"
|
||||
echo "password=${TOKEN}"
|
||||
fi
|
||||
EOF
|
||||
chmod 700 "${HELPER_SCRIPT}"
|
||||
|
||||
git -c "credential.helper=${HELPER_SCRIPT}" \
|
||||
push "https://${PREFIX}/weichen/Agent-System.git" "${BRANCH}"
|
||||
|
||||
Reference in New Issue
Block a user