Harden Secrets and Configuration Boundaries in faucet - #295
Open
localtrade1 wants to merge 2 commits into
Open
Conversation
### Description This pull request addresses a High severity configuration management finding from the workspace security audit targeting the `faucet` repository. Previously, a `.env` file was tracked in git, and Docker's root-anchored `.dockerignore` did not exclude it. This created a severe risk where a developer populating the environment variables would accidentally commit live secrets—such as the Proof-of-Work HMAC key—directly to the repository or bake them into published container images. ### Key Changes & Remediations #### 1. Secrets Management & Repository Configuration (High) * **Template Renaming:** Renamed the tracked `bin/faucet/.env` file to `bin/faucet/.env.example` to serve purely as a template[cite: 28]. * **Strict Git Ignores:** Updated `.gitignore` to explicitly ignore `.env` and `.env.*` files, while negating the template (`!.env.example`) so it remains tracked[cite: 27]. This structurally prevents `MIDEN_FAUCET_POW_SECRET` and operator account paths from being committed after a developer fills them in[cite: 27, 28]. #### 2. Documentation Updates * **Onboarding Instructions:** Updated `README.md` to explicitly instruct contributors to copy `.env.example` to `.env`[cite: 26]. It also includes a clear security warning explaining that `.env` is ignored by git, but `.env.example` is not, ensuring real secrets stay out of the template[cite: 26]. *(Note: The audit report also identified that the `faucet` container currently runs as root (CWE-250)[cite: 25]. Transitioning to a non-root `USER` is strongly recommended, but it has been left out of this PR as it requires coordinated ownership changes to the `/faucet` volume mount that must be tested against existing deployments.)* ### How to Review 1. **Gitignore Rules**: Verify `.gitignore` correctly ignores `.env` files while preserving the template[cite: 27]. 2. **Template Validation**: Confirm that `bin/faucet/.env.example` contains only blank secret fields (e.g., `MIDEN_FAUCET_POW_SECRET=`)[cite: 28]. 3. **Documentation**: Review the updated Docker instructions in `README.md` to ensure the `.env` copying steps are clear[cite: 26].
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request addresses a High severity configuration management finding from the workspace security audit targeting the
faucetrepository. Previously, a.envfile was tracked in git, and Docker's root-anchored.dockerignoredid not exclude it. This created a severe risk where a developer populating the environment variables would accidentally commit live secrets—such as the Proof-of-Work HMAC key—directly to the repository or bake them into published container images.Key Changes & Remediations
1. Secrets Management & Repository Configuration (High)
bin/faucet/.envfile tobin/faucet/.env.exampleto serve purely as a template[cite: 28]..gitignoreto explicitly ignore.envand.env.*files, while negating the template (!.env.example) so it remains tracked[cite: 27]. This structurally preventsMIDEN_FAUCET_POW_SECRETand operator account paths from being committed after a developer fills them in[cite: 27, 28].2. Documentation Updates
README.mdto explicitly instruct contributors to copy.env.exampleto.env[cite: 26]. It also includes a clear security warning explaining that.envis ignored by git, but.env.exampleis not, ensuring real secrets stay out of the template[cite: 26].(Note: The audit report also identified that the
faucetcontainer currently runs as root (CWE-250)[cite: 25]. Transitioning to a non-rootUSERis strongly recommended, but it has been left out of this PR as it requires coordinated ownership changes to the/faucetvolume mount that must be tested against existing deployments.)How to Review
.gitignorecorrectly ignores.envfiles while preserving the template[cite: 27].bin/faucet/.env.examplecontains only blank secret fields (e.g.,MIDEN_FAUCET_POW_SECRET=)[cite: 28].README.mdto ensure the.envcopying steps are clear[cite: 26].