mirror of
https://github.com/Crosstalk-Solutions/project-nomad.git
synced 2026-03-30 13:39:25 +02:00
bc06965ec3
The benchmark submission HMAC signing secret was hardcoded in source code (CWE-798), allowing anyone reading the open-source repository to extract it and forge benchmark submissions to benchmark.projectnomad.us. - Read BENCHMARK_HMAC_SECRET from env instead of embedding it in code - Register the variable in the AdonisJS env schema (optional) - Add a guard in submitToRepository() that rejects submissions when the secret is not configured - Document the new variable in .env.example The benchmark server operator must now inject the real secret via the BENCHMARK_HMAC_SECRET environment variable (e.g. in docker-compose or a .env file). The previously committed secret should be rotated server-side.
71 lines
2.4 KiB
TypeScript
71 lines
2.4 KiB
TypeScript
/*
|
|
|--------------------------------------------------------------------------
|
|
| Environment variables service
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| The `Env.create` method creates an instance of the Env service. The
|
|
| service validates the environment variables and also cast values
|
|
| to JavaScript data types.
|
|
|
|
|
*/
|
|
|
|
import { Env } from '@adonisjs/core/env'
|
|
|
|
export default await Env.create(new URL('../', import.meta.url), {
|
|
NODE_ENV: Env.schema.enum(['development', 'production', 'test'] as const),
|
|
PORT: Env.schema.number(),
|
|
APP_KEY: Env.schema.string(),
|
|
HOST: Env.schema.string({ format: 'host' }),
|
|
URL: Env.schema.string(),
|
|
LOG_LEVEL: Env.schema.string(),
|
|
INTERNET_STATUS_TEST_URL: Env.schema.string.optional(),
|
|
|
|
/*
|
|
|----------------------------------------------------------
|
|
| Variables for configuring storage paths
|
|
|----------------------------------------------------------
|
|
*/
|
|
NOMAD_STORAGE_PATH: Env.schema.string.optional(),
|
|
|
|
/*
|
|
|----------------------------------------------------------
|
|
| Variables for configuring session package
|
|
|----------------------------------------------------------
|
|
*/
|
|
//SESSION_DRIVER: Env.schema.enum(['cookie', 'memory'] as const),
|
|
|
|
/*
|
|
|----------------------------------------------------------
|
|
| Variables for configuring the database package
|
|
|----------------------------------------------------------
|
|
*/
|
|
DB_HOST: Env.schema.string({ format: 'host' }),
|
|
DB_PORT: Env.schema.number(),
|
|
DB_USER: Env.schema.string(),
|
|
DB_PASSWORD: Env.schema.string.optional(),
|
|
DB_DATABASE: Env.schema.string(),
|
|
DB_SSL: Env.schema.boolean.optional(),
|
|
|
|
/*
|
|
|----------------------------------------------------------
|
|
| Variables for configuring the Redis connection
|
|
|----------------------------------------------------------
|
|
*/
|
|
REDIS_HOST: Env.schema.string({ format: 'host' }),
|
|
REDIS_PORT: Env.schema.number(),
|
|
|
|
/*
|
|
|----------------------------------------------------------
|
|
| Variables for configuring Project Nomad's external API URL
|
|
|----------------------------------------------------------
|
|
*/
|
|
NOMAD_API_URL: Env.schema.string.optional(),
|
|
|
|
/*
|
|
|----------------------------------------------------------
|
|
| Variables for configuring the benchmark submission secret
|
|
|----------------------------------------------------------
|
|
*/
|
|
BENCHMARK_HMAC_SECRET: Env.schema.string.optional(),
|
|
})
|