feat(lanes): per-lane database, Redis, and .env isolation (A1+A2)

Gives each lane its own slot-derived runtime (ports, detached process lifecycle, profile-driven hooks) and its own database/Redis logical index/.env file, so two lanes running the same repo's stack at once no longer share state. Machine-level DB/Redis credentials live at ~/.ccam/secrets.env (mode 0600, never returned by any route); a hook's output is redacted of that password (raw and URL-encoded forms) before it reaches a log file or the lane_hook_output websocket broadcast. Wired into provision/up/reset/remove; reset accepts --keep-db to skip the drop/recreate/migrate/reseed block entirely.
2026-08-04 10:03:40 +07:00
parent d71086f677
commit 9d145865dd
19 changed files with 3265 additions and 12 deletions
@@ -0,0 +1,79 @@
+/**
+ * @file Machine-level lane secrets: the database and Redis connection settings
+ * shared by every lane on this host. Deliberately NOT part of a repository's
+ * `.ccam/profile/` — a profile is committed and read by anyone who clones the
+ * repo, and a database password does not belong there. Lives instead at
+ * `~/.ccam/secrets.env`, parsed with the same literal `KEY=VALUE` reader
+ * `lane-profile.js` uses for `profile.env` (config is parsed, never sourced).
+ *
+ * Never returned by any route: `GET /runtime` may report which keys are
+ * present, never their values.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const { parseEnvFile } = require("./lane-profile");
+
+const SECRETS_PATH =
+  process.env.CCAM_SECRETS_PATH || path.join(os.homedir(), ".ccam", "secrets.env");
+
+/** Every declaration a lane's database/Redis facts can rely on when the file
+ *  is absent or unreadable — a local default stack, not a guess. */
+const DEFAULTS = Object.freeze({
+  PG_HOST: "127.0.0.1",
+  PG_PORT: "5432",
+  PG_USER: "postgres",
+  PG_PASS: "postgres",
+  REDIS_HOST: "127.0.0.1",
+  REDIS_PORT: "6379",
+});
+
+let warnedMissing = false;
+let warnedPerms = false;
+
+/**
+ * Read `~/.ccam/secrets.env`, merged over DEFAULTS.
+ *
+ * Never throws: a missing file warns once and falls back to DEFAULTS (a lane
+ * with no secrets file still gets a usable local Postgres/Redis target), and a
+ * file readable by group or world is refused outright rather than trusted —
+ * loading it would make CCAM the thing that taught a shared machine's other
+ * users the database password.
+ *
+ * @returns {Record<string,string>}
+ */
+function readSecrets() {
+  if (!fs.existsSync(SECRETS_PATH)) {
+    if (!warnedMissing) {
+      warnedMissing = true;
+      console.warn(
+        `[secrets] no ${SECRETS_PATH} — per-lane databases use built-in defaults ` +
+          `(${DEFAULTS.PG_HOST}:${DEFAULTS.PG_PORT})`
+      );
+    }
+    return { ...DEFAULTS };
+  }
+
+  const mode = fs.statSync(SECRETS_PATH).mode & 0o777;
+  if (mode & 0o077) {
+    if (!warnedPerms) {
+      warnedPerms = true;
+      console.warn(
+        `[secrets] ${SECRETS_PATH} is readable by group or world (mode ${mode.toString(8)}) ` +
+          `— refusing to load it. Fix with: chmod 600 ${SECRETS_PATH}`
+      );
+    }
+    return { ...DEFAULTS };
+  }
+
+  try {
+    return { ...DEFAULTS, ...parseEnvFile(fs.readFileSync(SECRETS_PATH, "utf8")) };
+  } catch {
+    return { ...DEFAULTS }; // unreadable file is the same as no file
+  }
+}
+
+module.exports = { SECRETS_PATH, DEFAULTS, readSecrets };