48 lines
1.3 KiB
Ruby
48 lines
1.3 KiB
Ruby
namespace :config do
|
|
desc 'Verify config/app.yml contains no real secrets (safe for git)'
|
|
task :check do
|
|
require_relative '../opendax/config_loader'
|
|
|
|
raw = YAML.load_file('config/app.yml')
|
|
leaks = []
|
|
|
|
check_value = lambda do |path, value|
|
|
return if value.nil?
|
|
return unless value.is_a?(String)
|
|
|
|
str = value.strip
|
|
return if str.empty? || str == 'changeme'
|
|
|
|
if str.match?(/\As\.[A-Za-z0-9]{20,}\z/)
|
|
leaks << "#{path}: looks like a Vault token"
|
|
elsif path.include?('password') && str != 'changeme'
|
|
leaks << "#{path}: non-placeholder password"
|
|
end
|
|
end
|
|
|
|
walk = lambda do |node, prefix|
|
|
case node
|
|
when Hash
|
|
node.each { |k, v| walk.call(v, prefix.empty? ? k.to_s : "#{prefix}.#{k}") }
|
|
when Array
|
|
node.each_with_index { |v, i| walk.call(v, "#{prefix}[#{i}]") }
|
|
else
|
|
check_value.call(prefix, node)
|
|
end
|
|
end
|
|
|
|
walk.call(raw, '')
|
|
|
|
if leaks.any?
|
|
puts 'FAIL: config/app.yml may contain secrets:'
|
|
leaks.each { |l| puts " - #{l}" }
|
|
puts 'Move sensitive values to config/app.local.yml or config/app.production.yml'
|
|
exit 1
|
|
end
|
|
|
|
overlay = Opendax::ConfigLoader.active_overlay
|
|
puts 'OK: config/app.yml looks safe for git'
|
|
puts "Active overlay: #{overlay || 'none'}"
|
|
end
|
|
end
|