From 61a09dce87e50bc70e8c3b1e8bb733b94179060b Mon Sep 17 00:00:00 2001 From: Jeppe B <2jepp9350@gmail.com> Date: Mon, 1 Jun 2026 22:01:39 +0200 Subject: [PATCH] Remove insecure default edge broker secret fallback --- docker-compose.example.yml | 4 ++-- docker-compose.prod.yml | 1 - services/edge-broker/test/config.test.mjs | 9 ++++----- services/nginx/app/classes/edge_broker_client.php | 3 +-- .../tests/Unit/Selfserve/EdgeBrokerClientConfigTest.php | 4 ++-- 5 files changed, 9 insertions(+), 12 deletions(-) diff --git a/docker-compose.example.yml b/docker-compose.example.yml index a0c0d23d..a5b820a2 100644 --- a/docker-compose.example.yml +++ b/docker-compose.example.yml @@ -88,7 +88,7 @@ services: environment: AUTO_COMPOSER_INSTALL: "true" EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300} - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-} volumes: - ./services/nginx/app:/var/www/html - ./services/edge-agent/dist:/services/edge-agent/dist:ro @@ -110,7 +110,7 @@ services: environment: AUTO_COMPOSER_INSTALL: "false" EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300} - EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev} + EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-} volumes: - ./services/nginx/app:/var/www/html - ./services/edge-agent/dist:/services/edge-agent/dist:ro diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index d62b3af9..64c39a78 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -9,7 +9,6 @@ services: ports: - "80:80" - "443:443" - - "4300:4300" redis: ports: [] healthcheck: diff --git a/services/edge-broker/test/config.test.mjs b/services/edge-broker/test/config.test.mjs index e778309b..c5cf96dc 100644 --- a/services/edge-broker/test/config.test.mjs +++ b/services/edge-broker/test/config.test.mjs @@ -6,10 +6,9 @@ const composeSource = readFileSync(new URL("../../../docker-compose.yml", import const traefikSource = readFileSync(new URL("../../../services/traefik/traefik.yml", import.meta.url), "utf8"); const traefikProdSource = readFileSync(new URL("../../../services/traefik/traefik.prod.yml", import.meta.url), "utf8"); -test("traefik exposes a dedicated edge broker entrypoint on port 4300", () => { +test("traefik defines a dedicated edge broker entrypoint on port 4300", () => { assert.match(traefikSource, /edge-broker:\s*\n\s*address:\s*":4300"/); assert.match(traefikProdSource, /edge-broker:\s*\n\s*address:\s*":4300"/); - assert.match(composeSource, /traefik:[\s\S]*ports:[\s\S]*"4300:4300"/); }); test("edge broker is routed through traefik on port 4300 for public api hosts", () => { @@ -18,9 +17,9 @@ test("edge broker is routed through traefik on port 4300 for public api hosts", assert.match(composeSource, /edge-broker:[\s\S]*traefik\.http\.services\.edge-broker\.loadbalancer\.server\.port=4300/); }); -test("php services receive the broker url and shared secret defaults", () => { +test("php services receive broker url defaults and require explicit broker shared secret", () => { assert.match(composeSource, /php1:[\s\S]*EDGE_BROKER_URL:\s*\$\{EDGE_BROKER_URL:-http:\/\/edge-broker:4300\}/); - assert.match(composeSource, /php1:[\s\S]*EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev\}/); + assert.match(composeSource, /php1:[\s\S]*EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-\}/); assert.match(composeSource, /php-staging:[\s\S]*EDGE_BROKER_URL:\s*\$\{EDGE_BROKER_URL:-http:\/\/edge-broker:4300\}/); - assert.match(composeSource, /php-cron:[\s\S]*EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev\}/); + assert.match(composeSource, /php-cron:[\s\S]*EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-\}/); }); diff --git a/services/nginx/app/classes/edge_broker_client.php b/services/nginx/app/classes/edge_broker_client.php index 0150d214..ff8d2cba 100644 --- a/services/nginx/app/classes/edge_broker_client.php +++ b/services/nginx/app/classes/edge_broker_client.php @@ -33,7 +33,6 @@ class edge_broker_http_exception extends Exception class edge_broker_client { private const DEFAULT_BROKER_URL = 'http://edge-broker:4300'; - private const DEFAULT_SHARED_SECRET = 'truckwash-edge-dev'; public function __construct( private readonly ?string $baseUrl = null, @@ -101,7 +100,7 @@ class edge_broker_client return trim((string)($this->sharedSecret ?? getenv('EDGE_BROKER_SHARED_SECRET') ?: getenv('EDGE_INTERNAL_SECRET') - ?: self::DEFAULT_SHARED_SECRET)); + ?: '')); } /** diff --git a/services/nginx/app/tests/Unit/Selfserve/EdgeBrokerClientConfigTest.php b/services/nginx/app/tests/Unit/Selfserve/EdgeBrokerClientConfigTest.php index 79a1a787..13d1c1d4 100644 --- a/services/nginx/app/tests/Unit/Selfserve/EdgeBrokerClientConfigTest.php +++ b/services/nginx/app/tests/Unit/Selfserve/EdgeBrokerClientConfigTest.php @@ -1,13 +1,13 @@ not->toBeFalse(); expect($source)->toContain("private const DEFAULT_BROKER_URL = 'http://edge-broker:4300';"); - expect($source)->toContain("private const DEFAULT_SHARED_SECRET = 'truckwash-edge-dev';"); expect($source)->toContain('class edge_broker_transport_exception extends Exception'); expect($source)->toContain('class edge_broker_http_exception extends Exception'); expect($source)->toContain("getenv('EDGE_BROKER_SHARED_SECRET')"); expect($source)->toContain("getenv('EDGE_INTERNAL_SECRET')"); + expect($source)->not->toContain('DEFAULT_SHARED_SECRET'); });