copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Remove insecure default edge broker secret fallback

Browse Source
This commit is contained in:
Jeppe B
2026-06-01 22:01:39 +02:00
parent 745e68aa4f
commit 61a09dce87
5 changed files with 9 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-compose.example.yml
+2 -2
View File
@@ -88,7 +88,7 @@ services:
environment:
AUTO_COMPOSER_INSTALL: "true"
EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-}
volumes:
- ./services/nginx/app:/var/www/html
- ./services/edge-agent/dist:/services/edge-agent/dist:ro
@@ -110,7 +110,7 @@ services:
environment:
AUTO_COMPOSER_INSTALL: "false"
EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-}
volumes:
- ./services/nginx/app:/var/www/html
- ./services/edge-agent/dist:/services/edge-agent/dist:ro
docker-compose.prod.yml
-1
View File
@@ -9,7 +9,6 @@ services:
ports:
- "80:80"
- "443:443"
- "4300:4300"
redis:
ports: []
healthcheck:
services/edge-broker/test/config.test.mjs
+4 -5
View File
@@ -6,10 +6,9 @@ const composeSource = readFileSync(new URL("../../../docker-compose.yml", import
const traefikSource = readFileSync(new URL("../../../services/traefik/traefik.yml", import.meta.url), "utf8");
const traefikProdSource = readFileSync(new URL("../../../services/traefik/traefik.prod.yml", import.meta.url), "utf8");
test("traefik exposes a dedicated edge broker entrypoint on port 4300", () => {
test("traefik defines a dedicated edge broker entrypoint on port 4300", () => {
assert.match(traefikSource, /edge-broker:\s*\n\s*address:\s*":4300"/);
assert.match(traefikProdSource, /edge-broker:\s*\n\s*address:\s*":4300"/);
assert.match(composeSource, /traefik:[\s\S]*ports:[\s\S]*"4300:4300"/);
});
test("edge broker is routed through traefik on port 4300 for public api hosts", () => {
@@ -18,9 +17,9 @@ test("edge broker is routed through traefik on port 4300 for public api hosts",
assert.match(composeSource, /edge-broker:[\s\S]*traefik\.http\.services\.edge-broker\.loadbalancer\.server\.port=4300/);
});
test("php services receive the broker url and shared secret defaults", () => {
test("php services receive broker url defaults and require explicit broker shared secret", () => {
assert.match(composeSource, /php1:[\s\S]*EDGE_BROKER_URL:\s*\$\{EDGE_BROKER_URL:-http:\/\/edge-broker:4300\}/);
assert.match(composeSource, /php1:[\s\S]*EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev\}/);
assert.match(composeSource, /php1:[\s\S]*EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-\}/);
assert.match(composeSource, /php-staging:[\s\S]*EDGE_BROKER_URL:\s*\$\{EDGE_BROKER_URL:-http:\/\/edge-broker:4300\}/);
assert.match(composeSource, /php-cron:[\s\S]*EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev\}/);
assert.match(composeSource, /php-cron:[\s\S]*EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-\}/);
});
services/nginx/app/classes/edge_broker_client.php
+1 -2
View File
@@ -33,7 +33,6 @@ class edge_broker_http_exception extends Exception
class edge_broker_client
{
private const DEFAULT_BROKER_URL = 'http://edge-broker:4300';
private const DEFAULT_SHARED_SECRET = 'truckwash-edge-dev';
public function __construct(
private readonly ?string $baseUrl = null,
@@ -101,7 +100,7 @@ class edge_broker_client
return trim((string)($this->sharedSecret
?? getenv('EDGE_BROKER_SHARED_SECRET')
?: getenv('EDGE_INTERNAL_SECRET')
?: self::DEFAULT_SHARED_SECRET));
?: ''));
}
/**
services/nginx/app/tests/Unit/Selfserve/EdgeBrokerClientConfigTest.php
+2 -2
View File
@@ -1,13 +1,13 @@
<?php
it('uses the same default broker url and shared secret fallback as the docker stack', function (): void {
it('uses default broker url but requires explicit shared secret configuration', function (): void {
$source = file_get_contents(app_path('classes/edge_broker_client.php'));
expect($source)->not->toBeFalse();
expect($source)->toContain("private const DEFAULT_BROKER_URL = 'http://edge-broker:4300';");
expect($source)->toContain("private const DEFAULT_SHARED_SECRET = 'truckwash-edge-dev';");
expect($source)->toContain('class edge_broker_transport_exception extends Exception');
expect($source)->toContain('class edge_broker_http_exception extends Exception');
expect($source)->toContain("getenv('EDGE_BROKER_SHARED_SECRET')");
expect($source)->toContain("getenv('EDGE_INTERNAL_SECRET')");
expect($source)->not->toContain('DEFAULT_SHARED_SECRET');
});