Logan Cusano
e6aab7589a
The source password had a `hackme` fallback in five places -- entrypoint.sh,
docker-compose.yml, setup.sh's prompt default, .env.example, edge-node's
config.py -- plus op25-container's os.getenv default and two README rows. Any
node whose operator pressed Enter through setup.sh is running a credential
that is written down in this repo.
That matters more than the usual default-password case because Icecast binds
all interfaces and the SOURCE password is write access: it does not just let a
LAN neighbour listen, it lets them PUSH audio into the stream the frontend and
mobile clients play as live radio. Injecting fake traffic into a public-safety
feed is the failure worth preventing.
Approach: remove every fallback rather than change them to a better default.
- icecast/entrypoint.sh refuses to start if either password is empty, and says
how to generate one. This is the single hard gate; everything else is
defence in depth behind it.
- docker-compose.yml uses ${VAR:?message} so a missing value stops the stack
at compose time with a readable error instead of becoming an empty string.
- setup.sh GENERATES a random password when the operator presses Enter, via
openssl rand -base64 24 with a /dev/urandom fallback. Pressing Enter now
gives you a random password rather than a known one, which is the actual
behaviour change -- a prompt default nobody types over is not a default, it
is the value.
- .env.example ships the keys empty with the generation command in a comment,
and README.md now marks both as required with no default.
Client suite: 185 passed.
Note this does NOT rotate anything already deployed. node-002's .env still has
whatever it was set up with; that is an operational step, tracked in the issue.
Closes logan/node-26#3
54 lines
1.9 KiB
YAML
54 lines
1.9 KiB
YAML
services:
|
|
icecast:
|
|
image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/icecast:latest
|
|
build: ./icecast
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
environment:
|
|
# :? not :- — a missing password must stop the stack, not silently
|
|
# become a credential that is published in this file.
|
|
ICECAST_SOURCE_PASSWORD: ${ICECAST_SOURCE_PASSWORD:?set ICECAST_SOURCE_PASSWORD in .env (run setup.sh, or openssl rand -base64 24)}
|
|
ICECAST_ADMIN_PASSWORD: ${ICECAST_ADMIN_PASSWORD:?set ICECAST_ADMIN_PASSWORD in .env (run setup.sh, or openssl rand -base64 24)}
|
|
|
|
# No `ports:` here — network_mode: host makes it a no-op either way. The
|
|
# control API (:8001) and OP25's HTTP terminal (:8081) are unauthenticated,
|
|
# so they bind 127.0.0.1 by default (see OP25_DEBUG_EXPOSE in .env.example)
|
|
# rather than being exposed. edge-node still reaches both over localhost
|
|
# because it shares this host network namespace.
|
|
op25:
|
|
image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/op25-client:stable
|
|
build: ./op25-container
|
|
restart: unless-stopped
|
|
privileged: true
|
|
network_mode: host
|
|
env_file: .env
|
|
volumes:
|
|
- ./configs:/configs
|
|
- /dev:/dev
|
|
- ./op25-container/app:/app
|
|
- pulse_socket:/run/pulse
|
|
environment:
|
|
PULSE_SERVER: unix:/run/pulse/native
|
|
depends_on:
|
|
- icecast
|
|
|
|
edge-node:
|
|
image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/edge-node:latest
|
|
build: ./drb-edge-node
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
env_file: .env
|
|
volumes:
|
|
- ./configs:/configs
|
|
- ./recordings:/recordings
|
|
- ./drb-edge-node/app:/app/app
|
|
- pulse_socket:/run/pulse
|
|
environment:
|
|
PULSE_SERVER: unix:/run/pulse/native
|
|
depends_on:
|
|
- icecast
|
|
- op25
|
|
|
|
volumes:
|
|
pulse_socket:
|