security: harden data auth and deployment

scripts/deploy_ams_dev01.sh

@@ -7,7 +7,7 @@ cd "$repo_root"
 deploy_host="${DEPLOY_HOST:-AMS-DEV01}"
 deploy_user="${DEPLOY_USER:-zak}"
 deploy_path="${DEPLOY_PATH:-/home/${deploy_user}/magent}"
-ssh_opts="${DEPLOY_SSH_OPTS:-"-o StrictHostKeyChecking=accept-new"}"
+ssh_opts="${DEPLOY_SSH_OPTS:-"-o StrictHostKeyChecking=yes"}"
 timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
 
 remote="${deploy_user}@${deploy_host}"
@@ -16,9 +16,12 @@ echo "Deploying tracked repository contents to ${remote}:${deploy_path}"
 
 git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
   set -e
+  umask 077
   mkdir -p '${deploy_path}'
+  chmod 700 '${deploy_path}'
   backup_root=\"\${HOME}/magent-backups/${timestamp}\"
   mkdir -p \"\${backup_root}\"
+  chmod 700 \"\${backup_root}\"
   cd '${deploy_path}'
   for path in backend frontend docker-compose.yml docker-compose.hub.yml Dockerfile README.md docker scripts .build_number .gitattributes .gitignore; do
     if [ -e \"\$path\" ]; then
@@ -26,7 +29,20 @@ git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
     fi
   done
   tar -xf - -C '${deploy_path}'
-  docker compose up -d --build
+  if [ -f '${deploy_path}/.env' ]; then
+    chmod 600 '${deploy_path}/.env'
+  fi
+  mkdir -p '${deploy_path}/data'
+  chmod 700 '${deploy_path}/data'
+  docker compose build
+  if ! grep -Eq '^[[:space:]]*SETTINGS_ENCRYPTION_KEY=' .env; then
+    settings_key=\"\$(docker compose run --rm --no-deps --entrypoint python magent -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())')\"
+    printf '\nSETTINGS_ENCRYPTION_KEY=%s\n' \"\${settings_key}\" >> .env
+    chmod 600 .env
+  fi
+  docker compose run --rm --no-deps --entrypoint python magent -c \"from app.config import settings; from app.secret_storage import validate_secret_storage_configuration; assert len(str(settings.jwt_secret or '').strip()) >= 32, 'JWT_SECRET must contain at least 32 characters'; validate_secret_storage_configuration()\"
+  docker compose run --rm --user 0 magent chown -R 1000:1000 /app/data
+  docker compose up -d
 "
 
 echo "Running remote smoke checks"

scripts/deploy_beta_ams_dev01.sh

@@ -9,7 +9,7 @@ deploy_user="${DEPLOY_USER:-zak}"
 prod_path="${PROD_DEPLOY_PATH:-/home/${deploy_user}/magent}"
 deploy_path="${BETA_DEPLOY_PATH:-/home/${deploy_user}/magent-beta}"
 beta_frontend_bind="${BETA_FRONTEND_BIND:-10.30.1.32}"
-ssh_opts="${DEPLOY_SSH_OPTS:-"-o StrictHostKeyChecking=accept-new"}"
+ssh_opts="${DEPLOY_SSH_OPTS:-"-o StrictHostKeyChecking=yes"}"
 timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
 
 remote="${deploy_user}@${deploy_host}"
@@ -18,9 +18,12 @@ echo "Deploying tracked beta repository contents to ${remote}:${deploy_path}"
 
 git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
   set -e
+  umask 077
   mkdir -p '${deploy_path}'
+  chmod 700 '${deploy_path}'
   backup_root=\"\${HOME}/magent-beta-backups/${timestamp}\"
   mkdir -p \"\${backup_root}\"
+  chmod 700 \"\${backup_root}\"
   cd '${deploy_path}'
   for path in backend frontend docker-compose.yml docker-compose.hub.yml docker-compose.beta.yml Dockerfile README.md docker scripts .build_number .gitattributes .gitignore; do
     if [ -e \"\$path\" ]; then
@@ -32,14 +35,25 @@ git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
   if [ ! -f '${deploy_path}/.env' ] && [ -f '${prod_path}/.env' ]; then
     cp '${prod_path}/.env' '${deploy_path}/.env'
   fi
+  if [ -f '${deploy_path}/.env' ]; then
+    chmod 600 '${deploy_path}/.env'
+  fi
 
   mkdir -p '${deploy_path}/data'
+  chmod 700 '${deploy_path}/data'
   if [ ! -f '${deploy_path}/data/magent.db' ] && [ -d '${prod_path}/data' ]; then
     cp -a '${prod_path}/data/.' '${deploy_path}/data/'
   fi
 
   cd '${deploy_path}'
   docker compose -p magent-beta -f docker-compose.beta.yml build
+  if ! grep -Eq '^[[:space:]]*SETTINGS_ENCRYPTION_KEY=' .env; then
+    settings_key=\"\$(docker compose -p magent-beta -f docker-compose.beta.yml run --rm --no-deps --entrypoint python magent -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())')\"
+    printf '\nSETTINGS_ENCRYPTION_KEY=%s\n' \"\${settings_key}\" >> .env
+    chmod 600 .env
+  fi
+  docker compose -p magent-beta -f docker-compose.beta.yml run --rm --no-deps --entrypoint python magent -c \"from app.config import settings; from app.secret_storage import validate_secret_storage_configuration; assert len(str(settings.jwt_secret or '').strip()) >= 32, 'JWT_SECRET must contain at least 32 characters'; validate_secret_storage_configuration()\"
+  docker compose -p magent-beta -f docker-compose.beta.yml run --rm --user 0 magent chown -R 1000:1000 /app/data
   docker compose -p magent-beta -f docker-compose.beta.yml up -d
 "
 

scripts/prepare_production_settings.py

@@ -9,6 +9,8 @@ from pathlib import Path
 import secrets
 import sys
 
+from cryptography.fernet import Fernet
+
 from app.runtime import get_runtime_settings
 
 
@@ -30,6 +32,7 @@ def prepare(destination: Path) -> None:
     password = secrets.token_urlsafe(30)
     values.update(
         APP_NAME='Magent', JWT_SECRET=secrets.token_urlsafe(48),
+        SETTINGS_ENCRYPTION_KEY=Fernet.generate_key().decode('ascii'),
         ADMIN_USERNAME='admin', ADMIN_PASSWORD=password,
         AUTH_COOKIE_SECURE=True, AUTH_COOKIE_DOMAIN='magent.grizzlyflix.co.nz',
         AUTH_COOKIE_NAME='magent_auth', AUTH_STATE_COOKIE_NAME='magent_logged_in',