SECURITY - PLATFORM: add staging hardening baseline

2026-05-12 12:57:56 +03:00
parent 95072586b9
commit 0e462012da
5 changed files with 377 additions and 2 deletions
@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${1:-"$ROOT_DIR/.env.staging"}"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "Missing staging env file: $ENV_FILE" >&2
+  exit 1
+fi
+
+set -a
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+set +a
+
+failures=0
+
+fail() {
+  echo "FAIL: $*" >&2
+  failures=$((failures + 1))
+}
+
+require_value() {
+  local name="$1"
+  local value="${!name:-}"
+
+  if [[ -z "$value" ]]; then
+    fail "$name is required"
+  fi
+}
+
+require_secret() {
+  local name="$1"
+  local value="${!name:-}"
+
+  require_value "$name"
+
+  if [[ "$value" =~ change-me|local-dev|replace-with|example ]]; then
+    fail "$name uses a placeholder/dev value"
+  fi
+
+  if [[ ${#value} -lt 32 ]]; then
+    fail "$name must be at least 32 characters"
+  fi
+}
+
+require_https_url() {
+  local name="$1"
+  local value="${!name:-}"
+
+  require_value "$name"
+
+  if [[ "$value" != https://* ]]; then
+    fail "$name must use https://"
+  fi
+}
+
+require_staging_domain() {
+  local name="$1"
+  local value="${!name:-}"
+
+  require_value "$name"
+
+  if [[ "$value" == *.local.nodedc || "$value" == "localhost" || "$value" == 127.* ]]; then
+    fail "$name must not use local/dev domain"
+  fi
+}
+
+require_value AUTH_DOMAIN
+require_value LAUNCHER_DOMAIN
+require_value TASK_DOMAIN
+require_value STAGING_LAUNCHER_UPSTREAM
+require_value STAGING_TASK_MANAGER_UPSTREAM
+require_value AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS
+
+require_staging_domain AUTH_DOMAIN
+require_staging_domain LAUNCHER_DOMAIN
+require_staging_domain TASK_DOMAIN
+
+require_https_url LAUNCHER_OIDC_ISSUER
+require_https_url LAUNCHER_OIDC_REDIRECT_URI
+require_https_url LAUNCHER_OIDC_LOGGED_OUT_REDIRECT_URI
+require_https_url PLANE_OIDC_ISSUER
+require_https_url PLANE_OIDC_REDIRECT_URI
+
+require_secret PG_PASS
+require_secret AUTHENTIK_SECRET_KEY
+require_secret SESSION_SECRET
+require_secret NODEDC_INTERNAL_ACCESS_TOKEN
+require_secret LAUNCHER_OIDC_CLIENT_SECRET
+require_secret PLANE_OIDC_CLIENT_SECRET
+
+if [[ "${COOKIE_SECURE:-}" != "true" ]]; then
+  fail "COOKIE_SECURE must be true"
+fi
+
+if [[ "${COOKIE_DOMAIN:-}" == *.local.nodedc || "${COOKIE_DOMAIN:-}" == "localhost" ]]; then
+  fail "COOKIE_DOMAIN must not use local/dev domain"
+fi
+
+if [[ "${NODEDC_INTERNAL_ACCESS_TOKEN:-}" == "${LAUNCHER_OIDC_CLIENT_SECRET:-}" ]]; then
+  fail "NODEDC_INTERNAL_ACCESS_TOKEN must differ from LAUNCHER_OIDC_CLIENT_SECRET"
+fi
+
+if [[ "${NODEDC_INTERNAL_ACCESS_TOKEN:-}" == "${PLANE_OIDC_CLIENT_SECRET:-}" ]]; then
+  fail "NODEDC_INTERNAL_ACCESS_TOKEN must differ from PLANE_OIDC_CLIENT_SECRET"
+fi
+
+if [[ "${LAUNCHER_OIDC_CLIENT_SECRET:-}" == "${PLANE_OIDC_CLIENT_SECRET:-}" ]]; then
+  fail "Launcher and Tasker OIDC client secrets must differ"
+fi
+
+if [[ "${PLANE_NODEDC_ACCESS_TOKEN:-}" != "${NODEDC_INTERNAL_ACCESS_TOKEN:-}" ]]; then
+  fail "PLANE_NODEDC_ACCESS_TOKEN must match NODEDC_INTERNAL_ACCESS_TOKEN"
+fi
+
+if [[ "${PLANE_NODEDC_ACCESS_ENFORCEMENT:-}" != "1" ]]; then
+  fail "PLANE_NODEDC_ACCESS_ENFORCEMENT must be 1"
+fi
+
+if [[ "${PLANE_NODEDC_ACCESS_ENFORCE_UNLINKED:-}" != "1" ]]; then
+  fail "PLANE_NODEDC_ACCESS_ENFORCE_UNLINKED must be 1"
+fi
+
+case "${AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS:-}" in
+  *"0.0.0.0/0"*|*"::/0"*|*"10.0.0.0/8"*|*"172.16.0.0/12"*|*"192.168.0.0/16"*|*"127.0.0.0/8"*)
+    fail "AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS must be limited to the actual reverse-proxy/ingress subnet"
+    ;;
+esac
+
+if [[ $failures -gt 0 ]]; then
+  echo "Staging env check failed with $failures issue(s)." >&2
+  exit 1
+fi
+
+echo "Staging env check passed: $ENV_FILE"