security: harden data auth and deployment

scripts/deploy_ams_dev01.sh

@@ -7,7 +7,7 @@ cd "$repo_root"
 deploy_host="${DEPLOY_HOST:-AMS-DEV01}"
 deploy_user="${DEPLOY_USER:-zak}"
 deploy_path="${DEPLOY_PATH:-/home/${deploy_user}/magent}"
-ssh_opts="${DEPLOY_SSH_OPTS:-"-o StrictHostKeyChecking=accept-new"}"
+ssh_opts="${DEPLOY_SSH_OPTS:-"-o StrictHostKeyChecking=yes"}"
 timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
 
 remote="${deploy_user}@${deploy_host}"
@@ -16,9 +16,12 @@ echo "Deploying tracked repository contents to ${remote}:${deploy_path}"
 
 git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
   set -e
+  umask 077
   mkdir -p '${deploy_path}'
+  chmod 700 '${deploy_path}'
   backup_root=\"\${HOME}/magent-backups/${timestamp}\"
   mkdir -p \"\${backup_root}\"
+  chmod 700 \"\${backup_root}\"
   cd '${deploy_path}'
   for path in backend frontend docker-compose.yml docker-compose.hub.yml Dockerfile README.md docker scripts .build_number .gitattributes .gitignore; do
     if [ -e \"\$path\" ]; then
@@ -26,7 +29,20 @@ git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
     fi
   done
   tar -xf - -C '${deploy_path}'
-  docker compose up -d --build
+  if [ -f '${deploy_path}/.env' ]; then
+    chmod 600 '${deploy_path}/.env'
+  fi
+  mkdir -p '${deploy_path}/data'
+  chmod 700 '${deploy_path}/data'
+  docker compose build
+  if ! grep -Eq '^[[:space:]]*SETTINGS_ENCRYPTION_KEY=' .env; then
+    settings_key=\"\$(docker compose run --rm --no-deps --entrypoint python magent -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())')\"
+    printf '\nSETTINGS_ENCRYPTION_KEY=%s\n' \"\${settings_key}\" >> .env
+    chmod 600 .env
+  fi
+  docker compose run --rm --no-deps --entrypoint python magent -c \"from app.config import settings; from app.secret_storage import validate_secret_storage_configuration; assert len(str(settings.jwt_secret or '').strip()) >= 32, 'JWT_SECRET must contain at least 32 characters'; validate_secret_storage_configuration()\"
+  docker compose run --rm --user 0 magent chown -R 1000:1000 /app/data
+  docker compose up -d
 "
 
 echo "Running remote smoke checks"