forked from claude-did-this/claude-hub
7e545475d0
Replace environment variable credentials with secure file-based mounting to prevent runtime credential exposure that was causing security leaks. Key security improvements: - Docker secrets integration for credential mounting - Secure credential loader utility (secureCredentials.js) - Enhanced logging redaction for all credential types - Pre-commit security scanning with multiple tools - Automated security audit workflow and scripts - File-based credentials with proper 600 permissions Services updated: - githubController.js: Use secure credentials for webhook verification - claudeService.js: Use secure credentials for GitHub/Anthropic APIs - githubService.js: Use secure credentials for GitHub API calls - logger.js: Enhanced redaction patterns for all credential types New security infrastructure: - ./scripts/setup/setup-secure-credentials.sh: Setup script for secure credentials - ./scripts/security/credential-audit.sh: Comprehensive security audit - .github/workflows/security-audit.yml: Automated security scanning - docker-compose.yml: Updated to use Docker secrets by default - k8s/secrets.yaml: Kubernetes secrets configuration - systemd/claude-webhook.service: Systemd service configuration This eliminates credential exposure in: - Environment variables and process lists - Container logs and debug output - Git commits and PR comments - Runtime error messages 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
56 lines
1.4 KiB
YAML
56 lines
1.4 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: claude-webhook-secrets
|
|
namespace: default
|
|
type: Opaque
|
|
stringData:
|
|
github-token: "YOUR_GITHUB_TOKEN_HERE"
|
|
anthropic-api-key: "YOUR_ANTHROPIC_API_KEY_HERE"
|
|
webhook-secret: "YOUR_WEBHOOK_SECRET_HERE"
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: claude-webhook
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: claude-webhook
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: claude-webhook
|
|
spec:
|
|
containers:
|
|
- name: webhook
|
|
image: claude-webhook:latest
|
|
ports:
|
|
- containerPort: 3002
|
|
env:
|
|
- name: NODE_ENV
|
|
value: "production"
|
|
- name: PORT
|
|
value: "3002"
|
|
- name: GITHUB_TOKEN_FILE
|
|
value: "/etc/secrets/github-token"
|
|
- name: ANTHROPIC_API_KEY_FILE
|
|
value: "/etc/secrets/anthropic-api-key"
|
|
- name: GITHUB_WEBHOOK_SECRET_FILE
|
|
value: "/etc/secrets/webhook-secret"
|
|
volumeMounts:
|
|
- name: secrets-volume
|
|
mountPath: /etc/secrets
|
|
readOnly: true
|
|
volumes:
|
|
- name: secrets-volume
|
|
secret:
|
|
secretName: claude-webhook-secrets
|
|
items:
|
|
- key: github-token
|
|
path: github-token
|
|
- key: anthropic-api-key
|
|
path: anthropic-api-key
|
|
- key: webhook-secret
|
|
path: webhook-secret |