Merge pull request #113 from sirius0xdev/fix/security-audit-critical-may2026

fix: security audit fixes — SOPS encrypt secrets + admin auth + email enum
2026-05-14 22:15:59 -04:00 · 2026-05-14 22:15:59 -04:00 · 0bba6d6f2b
commit 0bba6d6f2b
parent 36b1d637f1 334be37781
5 changed files with 108 additions and 4 deletions
--- a/apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml
+++ b/apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml
@ -5,9 +5,25 @@ metadata:
    namespace: customer1
 type: Opaque
 stringData:
-    username: waitlist
-    password: CHANGEME
+    username: ENC[AES256_GCM,data:Gla9qDWPnL4=,iv:fOFJEBrZ2C6UChUhIKbG3pcO0Zkiv0WGybWoW+5UOXU=,tag:5QulFOKmUb8g89Ssv/4pKg==,type:str]
+    password: ENC[AES256_GCM,data:fMajWmKxkD2ezhLfSvnGG3lMabgVSHCCr9ORtVnj7apfW9L3+xaVI3b0sYJD4vP7,iv:6qs2FTP7GuNCFB2YyK77MDtYLrcC+WuiWpo6NmTH7EE=,tag:ppcc4+aBDJL0akE02Q5n7g==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
    age:
        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOdVJZT2twOHFDRHgzaWVm
+            WWcxODRhSG5jSTNITnZsRHR1dnB6NVpqMFN3CkxUMElMcEN4dEdrZXQ4Z1dkMk9G
+            ZWYrTGFkMHhrb3UrUWJYRTlzc0xiS0EKLS0tICtLNC9qZk5VSnE3K3NtUGx6USsv
+            a3hXaG1rYlI5ampRSlFXWktTSzhtem8KVRHAel5jBPiMMDT7bYboorkryiuvdjOL
+            +uD/aMZT04vyeG9i1d4peeab/NP8jmnxWKJOftGKN3PIqPYrZ6OHCQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-15T01:35:29Z"
+    mac: ENC[AES256_GCM,data:s3/3/oKVNisc9LVUUzbMPvnaPTR3DJ0pPzYQpxCKkVJ7Cu0GOOsWQBUsgB3wfzLAWSGD2vTYLabzczTRXTkwq5R66ySv1FUOJjAxnZJhwLqcST5+wSzzNczEMbJFBhZepPUNZsMuqkHElQ5f3xZIfo71QITBmrdtg3wEvkHqPrM=,iv:ItkjTFniNlhx3PGoIZUXMtOpBNE5MyqElMFE9rojkOc=,tag:KGW3lD++RvI46lDUTmc7SA==,type:str]
+    pgp: []
    encrypted_regex: ^(data|stringData)$
+    version: 3.9.0
--- a/apps/base/customer1/waitlist-api/deployment.yaml
+++ b/apps/base/customer1/waitlist-api/deployment.yaml
@ -13,6 +13,12 @@ spec:
      labels:
        app: waitlist-api
    spec:
+      serviceAccountName: waitlist-api
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
      containers:
      - name: api
        image: ghcr.io/sirius0xdev/waitlist-api:latest
@ -20,6 +26,12 @@ spec:
        ports:
        - containerPort: 8080
          protocol: TCP
+        securityContext:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
        env:
        - name: DB_HOST
          value: "siriusdevops-pgdb-rw.customer1.svc.cluster.local"
@ -47,6 +59,11 @@ spec:
            secretKeyRef:
              name: waitlist-telegram-secret
              key: chat_id
+        - name: ADMIN_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: waitlist-telegram-secret
+              key: admin_api_key
        resources:
          requests:
            cpu: 50m
@ -55,6 +72,11 @@ spec:
            cpu: 200m
            memory: 256Mi

+        volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+          readOnly: false
+
        startupProbe:
          httpGet:
            path: /healthz
@ -88,6 +110,10 @@ spec:
          failureThreshold: 3
          successThreshold: 1

+      volumes:
+      - name: tmp
+        emptyDir: {}
+
 ---
 apiVersion: v1
 kind: Service
--- a/apps/base/customer1/waitlist-api/kustomization.yaml
+++ b/apps/base/customer1/waitlist-api/kustomization.yaml
@ -4,3 +4,4 @@ resources:
  - deployment.yaml
  - waitlist-telegram-secret.yaml
  - http-route.yaml
+  - network-policy.yaml
--- a/apps/base/customer1/waitlist-api/network-policy.yaml
+++ b/apps/base/customer1/waitlist-api/network-policy.yaml
@ -0,0 +1,44 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: waitlist-api-egress
+  namespace: customer1
+spec:
+  podSelector:
+    matchLabels:
+      app: waitlist-api
+  policyTypes:
+    - Egress
+  egress:
+    # Allow DNS resolution (required for api.telegram.org lookups)
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+        - podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    # Allow PostgreSQL to CNPG cluster
+    - to:
+        - podSelector:
+            matchLabels:
+              cnpg.io/cluster: siriusdevops-pgdb
+      ports:
+        - protocol: TCP
+          port: 5432
+    # Allow Telegram Bot API
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - protocol: TCP
+          port: 443
--- a/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml
+++ b/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml
@ -5,9 +5,26 @@ metadata:
    namespace: customer1
 type: Opaque
 stringData:
-    bot_token: CHANGEME
-    chat_id: CHANGEME
+    bot_token: ENC[AES256_GCM,data:LKtH09TKaOwlmZ6MplFC3PIltAnuc3peljdpQ+dv1FFYEETrM5ktC6kgSVEZYg==,iv:6SO9vYXrPgWWHD7JOBMv185VbrlhVy8J4bOujqFg2kk=,tag:wlIQPf/CpwQa67Q4rhgLWw==,type:str]
+    chat_id: ENC[AES256_GCM,data:/PDKXjKoOT/3TQ==,iv:cABt0cLh7P1aRZ2xvCiEQSGbsh+Er7GGLpIcomTysk4=,tag:fBIvsK59wJjXyyjcOWBu5A==,type:str]
+    admin_api_key: ENC[AES256_GCM,data:CJX1+BDOxhAZIF8ZZ/guENjM6RL2IQh8jKjRPF+QdzU=,iv:kngkGX6K8ePmrU2+Awsrg5OuPvsasMFmAwoTT0gW+Yk=,tag:cbDVxecQKWuy+tQKhrEnNQ==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
    age:
        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dGNjV2xvMTZ6eWVNUk9w
+            M04xVDBrYjFkSTFGem9pT2VKbGR2L0tRM1hjClFlcWJQU3hjZ0EwNzRoMXNXYkVI
+            RlNWT29oQ2dOaDZPaFVTNVFrQWpHYkkKLS0tIHQ0R2gwdVUyN3lXRlBlVWd6WEZV
+            NkoybXJYMkVJcWFuay9ycE1Tc2dpOFUKZzTATUeC53NTK8eXunGdpeKeQnXLTb5E
+            C2VoGFnmqyJMnH/cN8Q6zrSmFqyt2LX6H1z26StHwF6Rgs+MlCdiVQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-15T02:10:31Z"
+    mac: ENC[AES256_GCM,data:OAq/3HdIF2aPo0RqjjMKmeZPeE16S4CiaoVEJAQVqOfQFp4XDW0j50iKNwfDrXate4X1bv+g0qYLPyXq6ZoZuExsYuUuUskZevWDNqcyNcQ0joe5WntCqgy14Q8/WP9gKighG/UVTojxMcMn6afEjnXcN7XaWk/p1Atmys3eVNo=,iv:U61p5bALcibbfI99yayRTKZ+/HZ+HCaJztWVGGq08Ww=,tag:5MPfVnsDDTFNo3OZuvGvMw==,type:str]
+    pgp: []
    encrypted_regex: ^(data|stringData)$
+    version: 3.9.0