nntrivi2001
9d145865dd
Gives each lane its own slot-derived runtime (ports, detached process lifecycle, profile-driven hooks) and its own database/Redis logical index/.env file, so two lanes running the same repo's stack at once no longer share state. Machine-level DB/Redis credentials live at ~/.ccam/secrets.env (mode 0600, never returned by any route); a hook's output is redacted of that password (raw and URL-encoded forms) before it reaches a log file or the lane_hook_output websocket broadcast. Wired into provision/up/reset/remove; reset accepts --keep-db to skip the drop/recreate/migrate/reseed block entirely.
80 lines
2.6 KiB
JavaScript
80 lines
2.6 KiB
JavaScript
/**
|
|
* @file Machine-level lane secrets: the database and Redis connection settings
|
|
* shared by every lane on this host. Deliberately NOT part of a repository's
|
|
* `.ccam/profile/` — a profile is committed and read by anyone who clones the
|
|
* repo, and a database password does not belong there. Lives instead at
|
|
* `~/.ccam/secrets.env`, parsed with the same literal `KEY=VALUE` reader
|
|
* `lane-profile.js` uses for `profile.env` (config is parsed, never sourced).
|
|
*
|
|
* Never returned by any route: `GET /runtime` may report which keys are
|
|
* present, never their values.
|
|
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
|
*/
|
|
|
|
const fs = require("node:fs");
|
|
const os = require("node:os");
|
|
const path = require("node:path");
|
|
|
|
const { parseEnvFile } = require("./lane-profile");
|
|
|
|
const SECRETS_PATH =
|
|
process.env.CCAM_SECRETS_PATH || path.join(os.homedir(), ".ccam", "secrets.env");
|
|
|
|
/** Every declaration a lane's database/Redis facts can rely on when the file
|
|
* is absent or unreadable — a local default stack, not a guess. */
|
|
const DEFAULTS = Object.freeze({
|
|
PG_HOST: "127.0.0.1",
|
|
PG_PORT: "5432",
|
|
PG_USER: "postgres",
|
|
PG_PASS: "postgres",
|
|
REDIS_HOST: "127.0.0.1",
|
|
REDIS_PORT: "6379",
|
|
});
|
|
|
|
let warnedMissing = false;
|
|
let warnedPerms = false;
|
|
|
|
/**
|
|
* Read `~/.ccam/secrets.env`, merged over DEFAULTS.
|
|
*
|
|
* Never throws: a missing file warns once and falls back to DEFAULTS (a lane
|
|
* with no secrets file still gets a usable local Postgres/Redis target), and a
|
|
* file readable by group or world is refused outright rather than trusted —
|
|
* loading it would make CCAM the thing that taught a shared machine's other
|
|
* users the database password.
|
|
*
|
|
* @returns {Record<string,string>}
|
|
*/
|
|
function readSecrets() {
|
|
if (!fs.existsSync(SECRETS_PATH)) {
|
|
if (!warnedMissing) {
|
|
warnedMissing = true;
|
|
console.warn(
|
|
`[secrets] no ${SECRETS_PATH} — per-lane databases use built-in defaults ` +
|
|
`(${DEFAULTS.PG_HOST}:${DEFAULTS.PG_PORT})`
|
|
);
|
|
}
|
|
return { ...DEFAULTS };
|
|
}
|
|
|
|
const mode = fs.statSync(SECRETS_PATH).mode & 0o777;
|
|
if (mode & 0o077) {
|
|
if (!warnedPerms) {
|
|
warnedPerms = true;
|
|
console.warn(
|
|
`[secrets] ${SECRETS_PATH} is readable by group or world (mode ${mode.toString(8)}) ` +
|
|
`— refusing to load it. Fix with: chmod 600 ${SECRETS_PATH}`
|
|
);
|
|
}
|
|
return { ...DEFAULTS };
|
|
}
|
|
|
|
try {
|
|
return { ...DEFAULTS, ...parseEnvFile(fs.readFileSync(SECRETS_PATH, "utf8")) };
|
|
} catch {
|
|
return { ...DEFAULTS }; // unreadable file is the same as no file
|
|
}
|
|
}
|
|
|
|
module.exports = { SECRETS_PATH, DEFAULTS, readSecrets };
|