Initial commit

lib/tasks/config.rake

@@ -0,0 +1,47 @@
+namespace :config do
+  desc 'Verify config/app.yml contains no real secrets (safe for git)'
+  task :check do
+    require_relative '../opendax/config_loader'
+
+    raw = YAML.load_file('config/app.yml')
+    leaks = []
+
+    check_value = lambda do |path, value|
+      return if value.nil?
+      return unless value.is_a?(String)
+
+      str = value.strip
+      return if str.empty? || str == 'changeme'
+
+      if str.match?(/\As\.[A-Za-z0-9]{20,}\z/)
+        leaks << "#{path}: looks like a Vault token"
+      elsif path.include?('password') && str != 'changeme'
+        leaks << "#{path}: non-placeholder password"
+      end
+    end
+
+    walk = lambda do |node, prefix|
+      case node
+      when Hash
+        node.each { |k, v| walk.call(v, prefix.empty? ? k.to_s : "#{prefix}.#{k}") }
+      when Array
+        node.each_with_index { |v, i| walk.call(v, "#{prefix}[#{i}]") }
+      else
+        check_value.call(prefix, node)
+      end
+    end
+
+    walk.call(raw, '')
+
+    if leaks.any?
+      puts 'FAIL: config/app.yml may contain secrets:'
+      leaks.each { |l| puts "  - #{l}" }
+      puts 'Move sensitive values to config/app.local.yml or config/app.production.yml'
+      exit 1
+    end
+
+    overlay = Opendax::ConfigLoader.active_overlay
+    puts 'OK: config/app.yml looks safe for git'
+    puts "Active overlay: #{overlay || 'none'}"
+  end
+end