Fail-fast secrets in stage/prod via EVENTHUB_ENV. Refs EventHub/EventHubBack#25

docker/.env.example

@@ -1,4 +1,21 @@
-# .env.example — закоммитьте этот файл, а реальный .env держите в .gitignore
+# Скопируйте в .env (файл .env в .gitignore). Для локальной разработки: EVENTHUB_ENV=dev
-RELEASE_COOKIE=ваш-очень-длинный-секретный-куки
+
+# Режим: dev | stage | prod (stage/prod — обязательные сильные секреты)
+EVENTHUB_ENV=dev
+
+RELEASE_COOKIE=ваш-очень-длинный-секретный-куки-минимум-32-символа
 GRAFANA_ADMIN_PASSWORD=сложный-уникальный-пароль
-JWT_SECRET=суперсекрет
+
+# JWT (минимум 32 символа, не из denylist — см. infra_secrets)
+JWT_SECRET=замените-на-случайную-строку-минимум-32-символа-для-user-jwt
+ADMIN_JWT_SECRET=замените-на-другую-случайную-строку-минимум-32-символа
+
+# Seed админов (обязательны в stage/prod при пустой таблице admin; в dev — опционально)
+ADMIN_SUPER_EMAIL=superadmin@eventhub.local
+ADMIN_SUPER_PASSWORD=замените-сильный-пароль-суперадмина
+ADMIN_EMAIL=admin@eventhub.local
+ADMIN_PASSWORD=замените-сильный-пароль-админа
+ADMIN_MODER_EMAIL=moderator@eventhub.local
+ADMIN_MODER_PASSWORD=замените-сильный-пароль-модератора
+ADMIN_SUPPORT_EMAIL=support@eventhub.local
+ADMIN_SUPPORT_PASSWORD=замените-сильный-пароль-поддержки

docker/.env.stage

@@ -1,12 +1,14 @@
+EVENTHUB_ENV=stage
 RELEASE_COOKIE=FuNHSU3SIiW8ICu2XIbl0pvpxAhpBvO2Wki7CT6q2bpHDSlQ8p7gtUgjnyXpPJU5
-GRAFANA_ADMIN_PASSWORD=admin
+GRAFANA_ADMIN_PASSWORD=замените-сильный-пароль-grafana
 JWT_SECRET=IDhKNFRLZFDYgPvVXwg4T7hAviQ2I1VGeEn5vXufQXK3AAErZuhMWy8J1uxJ0kGF
+ADMIN_JWT_SECRET=K3AAErZuhMWy8J1uxJ0kGFIDhKNFRLZFDYgPvVXwg4T7hAviQ2I1VGeEn5vXufQ
 TRAEFIK_LOG_PATH=/app/traefik/logs/access.log
 ADMIN_SUPER_EMAIL=superadmin@eventhub.local
-ADMIN_SUPER_PASSWORD=123456
+ADMIN_SUPER_PASSWORD=замените-сильный-пароль-суперадмина-мин32
 ADMIN_EMAIL=admin@eventhub.local
-ADMIN_PASSWORD=123456
+ADMIN_PASSWORD=замените-сильный-пароль-админа-минимум32
 ADMIN_MODER_EMAIL=moderator@eventhub.local
-ADMIN_MODER_PASSWORD=123456
+ADMIN_MODER_PASSWORD=замените-сильный-пароль-модератора-мин32
 ADMIN_SUPPORT_EMAIL=support@eventhub.local
-ADMIN_SUPPORT_PASSWORD=123456
+ADMIN_SUPPORT_PASSWORD=замените-сильный-пароль-поддержки-мин32

docker/docker-compose.stage.yml

@@ -26,13 +26,19 @@ services:
     image: git.sabilin.com/eventhub/eventhub:stage
     hostname: "eventhub-node{{.Task.Slot}}"
     environment:
+      - EVENTHUB_ENV=stage
       - NODE_NAME=eventhub-node{{.Task.Slot}}
       - RELEASE_COOKIE=${RELEASE_COOKIE}
       - JWT_SECRET=${JWT_SECRET}
+      - ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
       - ADMIN_SUPER_EMAIL=${ADMIN_SUPER_EMAIL}
       - ADMIN_SUPER_PASSWORD=${ADMIN_SUPER_PASSWORD}
       - ADMIN_EMAIL=${ADMIN_EMAIL}
       - ADMIN_PASSWORD=${ADMIN_PASSWORD}
+      - ADMIN_MODER_EMAIL=${ADMIN_MODER_EMAIL}
+      - ADMIN_MODER_PASSWORD=${ADMIN_MODER_PASSWORD}
+      - ADMIN_SUPPORT_EMAIL=${ADMIN_SUPPORT_EMAIL}
+      - ADMIN_SUPPORT_PASSWORD=${ADMIN_SUPPORT_PASSWORD}
       - CLUSTER_MODE=true
       - DNS_NAME=eventhub-node
     networks:

docker/docker-compose.swarm.yml

@@ -55,15 +55,19 @@ services:
     image: eventhub:latest
     hostname: "eventhub-node{{.Task.Slot}}"
     environment:
+      - EVENTHUB_ENV=prod
       - NODE_NAME=eventhub-node{{.Task.Slot}}
-      - RELEASE_COOKIE=${RELEASE_COOKIE:-eventhub_cookie}
+      - RELEASE_COOKIE=${RELEASE_COOKIE}
-      - JWT_SECRET=${JWT_SECRET:-eventhub_top_secret}
+      - JWT_SECRET=${JWT_SECRET}
-      - ADMIN_SUPER_EMAIL=${ADMIN_SUPER_EMAIL:-superadmin@eventhub.local}
+      - ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
-      - ADMIN_SUPER_PASSWORD=${ADMIN_SUPER_PASSWORD:-123456}
+      - ADMIN_SUPER_EMAIL=${ADMIN_SUPER_EMAIL}
-      - ADMIN_MODER_EMAIL=${ADMIN_MODER_EMAIL:-moderator@eventhub.local}
+      - ADMIN_SUPER_PASSWORD=${ADMIN_SUPER_PASSWORD}
-      - ADMIN_MODER_PASSWORD=${ADMIN_MODER_PASSWORD:-123456}
+      - ADMIN_EMAIL=${ADMIN_EMAIL}
-      - ADMIN_SUPPORT_EMAIL=${ADMIN_SUPPORT_EMAIL:-support@eventhub.local}
+      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
-      - ADMIN_SUPPORT_PASSWORD=${ADMIN_SUPPORT_PASSWORD:-123456}
+      - ADMIN_MODER_EMAIL=${ADMIN_MODER_EMAIL}
+      - ADMIN_MODER_PASSWORD=${ADMIN_MODER_PASSWORD}
+      - ADMIN_SUPPORT_EMAIL=${ADMIN_SUPPORT_EMAIL}
+      - ADMIN_SUPPORT_PASSWORD=${ADMIN_SUPPORT_PASSWORD}
       - CLUSTER_MODE=true
       - DNS_NAME=eventhub-node
     networks:

docker/docker-compose.yml

@@ -54,9 +54,11 @@ services:
       dockerfile: docker/Dockerfile
     hostname: eventhub-node1.local
     environment:
+      - EVENTHUB_ENV=dev
       - NODE_NAME=eventhub-node1@eventhub-node1.local
       - RELEASE_COOKIE=${RELEASE_COOKIE}
       - JWT_SECRET=${JWT_SECRET}
+      - ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
     networks:
       eventhub-net:
         aliases:
@@ -73,9 +75,11 @@ services:
       dockerfile: docker/Dockerfile
     hostname: eventhub-node2.local
     environment:
+      - EVENTHUB_ENV=dev
       - NODE_NAME=eventhub-node2@eventhub-node2.local
       - RELEASE_COOKIE=${RELEASE_COOKIE}
       - JWT_SECRET=${JWT_SECRET}
+      - ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
     networks:
       eventhub-net:
         aliases:
@@ -92,9 +96,11 @@ services:
       dockerfile: docker/Dockerfile
     hostname: eventhub-node3.local
     environment:
+      - EVENTHUB_ENV=dev
       - NODE_NAME=eventhub-node3@eventhub-node3.local
       - RELEASE_COOKIE=${RELEASE_COOKIE}
       - JWT_SECRET=${JWT_SECRET}
+      - ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
     networks:
       eventhub-net:
         aliases:

src/config/sys.config

@@ -4,7 +4,8 @@
     {ws_port, "${WS_PORT:-8081}"},
     {admin_http_port, "${ADMIN_HTTP_PORT:-8445}"},
     {admin_ws_port, "${ADMIN_WS_PORT:-8446}"},
-    {jwt_secret, <<"${JWT_SECRET:-change_me_in_production}">>}
+    {jwt_secret, <<"${JWT_SECRET:-change_me_in_production}">>},
+    {admin_jwt_secret, <<"${ADMIN_JWT_SECRET:-change_me_in_production}">>}
   ]},
   {kernel, [
     {logger_level, info},

src/eventhub_app.erl

@@ -3,6 +3,15 @@
 -export([start/2, stop/1]).
 
 start(_StartType, _StartArgs) ->
+  case infra_secrets:validate_startup() of
+    ok ->
+      start_application();
+    {error, Reason} ->
+      io:format("~nFATAL: secret validation failed: ~p~n", [Reason]),
+      {error, Reason}
+  end.
+
+start_application() ->
   case infra_sup:start_link() of
     {ok, Pid} ->
       % Определяем список узлов кластера, если режим CLUSTER_MODE=true
@@ -48,8 +57,10 @@ start(_StartType, _StartArgs) ->
       start_swagger_http(),  % Swagger UI и спецификация (8447)
       application:ensure_all_started(prometheus),
       application:ensure_all_started(prometheus_cowboy),
-      init_default_admins(),
+      case init_default_admins() of
-      {ok, Pid};
+        ok -> {ok, Pid};
+        {error, Reason} -> {error, Reason}
+      end;
     Error ->
       Error
   end.
@@ -199,31 +210,49 @@ start_swagger_http() ->
 init_default_admins() ->
   case core_admin:list_all() of
     [] ->
-      % Суперадмин
+      seed_default_admins();
-      SuperEmail = list_to_binary(os:getenv("ADMIN_SUPER_EMAIL", "superadmin@eventhub.local")),
-      SuperPass = list_to_binary(os:getenv("ADMIN_SUPER_PASSWORD", "123456")),
-      {ok, _} = core_admin:create(SuperEmail, SuperPass, superadmin),
-      io:format("Default superadmin created: ~s~n", [SuperEmail]),
-
-      % Админ
-      AdminEmail = list_to_binary(os:getenv("ADMIN_EMAIL", "admin@eventhub.local")),
-      AdminPass = list_to_binary(os:getenv("ADMIN_PASSWORD", "123456")),
-      {ok, _} = core_admin:create(AdminEmail, AdminPass, admin),
-      io:format("Default admin created: ~s~n", [AdminEmail]),
-
-      % Модератор
-      ModerEmail = list_to_binary(os:getenv("ADMIN_MODER_EMAIL", "moderator@eventhub.local")),
-      ModerPass = list_to_binary(os:getenv("ADMIN_MODER_PASSWORD", "123456")),
-      {ok, _} = core_admin:create(ModerEmail, ModerPass, moderator),
-      io:format("Default moderator created: ~s~n", [ModerEmail]),
-
-      % Поддержка
-      SupportEmail = list_to_binary(os:getenv("ADMIN_SUPPORT_EMAIL", "support@eventhub.local")),
-      SupportPass = list_to_binary(os:getenv("ADMIN_SUPPORT_PASSWORD", "123456")),
-      {ok, _} = core_admin:create(SupportEmail, SupportPass, support),
-      io:format("Default support created: ~s~n", [SupportEmail]);
     _ ->
-      io:format("Admins already exist. Skipping creation.~n")
+      io:format("Admins already exist. Skipping creation.~n"),
+      ok
+  end.
+
+seed_default_admins() ->
+  Admins = [
+    {superadmin, "ADMIN_SUPER_EMAIL", "superadmin@eventhub.local",
+      "ADMIN_SUPER_PASSWORD", "123456"},
+    {admin, "ADMIN_EMAIL", "admin@eventhub.local",
+      "ADMIN_PASSWORD", "123456"},
+    {moderator, "ADMIN_MODER_EMAIL", "moderator@eventhub.local",
+      "ADMIN_MODER_PASSWORD", "123456"},
+    {support, "ADMIN_SUPPORT_EMAIL", "support@eventhub.local",
+      "ADMIN_SUPPORT_PASSWORD", "123456"}
+  ],
+  lists:foldl(fun seed_admin/2, ok, Admins).
+
+seed_admin({Role, EmailKey, DefaultEmail, PassKey, DefaultPass}, ok) ->
+  case admin_credentials(EmailKey, DefaultEmail, PassKey, DefaultPass) of
+    {error, _} = Err -> Err;
+    {ok, {Email, Pass}} ->
+      {ok, _} = core_admin:create(Email, Pass, Role),
+      io:format("Default ~p created: ~s~n", [Role, Email]),
+      ok
+  end;
+seed_admin(_, Err) -> Err.
+
+admin_credentials(EmailKey, DefaultEmail, PassKey, DefaultPass) ->
+  case infra_secrets:is_dev() of
+    true ->
+      {ok, {list_to_binary(os:getenv(EmailKey, DefaultEmail)),
+            list_to_binary(os:getenv(PassKey, DefaultPass))}};
+    false ->
+      case infra_secrets:require_admin_seed_email(EmailKey) of
+        {error, _} = Err -> Err;
+        {ok, Email} ->
+          case infra_secrets:require_admin_seed_password(PassKey) of
+            {error, _} = Err -> Err;
+            {ok, Pass} -> {ok, {Email, Pass}}
+          end
+      end
   end.
 
 get_env_int(Key, Default) ->

src/infra/eventhub_auth.erl

@@ -24,7 +24,11 @@ get_user_secret() ->
 
 get_user_secret_from_env() ->
   case os:getenv("JWT_SECRET") of
-    false -> <<"user-secret-key-32-bytes-minimum!">>;
+    false ->
+      case infra_secrets:is_dev() of
+        true -> <<"user-secret-key-32-bytes-minimum!">>;
+        false -> error({missing_secret, jwt_secret})
+      end;
     S     -> list_to_binary(S)
   end.
 
@@ -37,7 +41,11 @@ get_admin_secret() ->
 
 get_admin_secret_from_env() ->
   case os:getenv("ADMIN_JWT_SECRET") of
-    false -> <<"admin-secret-key-32-bytes-minimum!">>;
+    false ->
+      case infra_secrets:is_dev() of
+        true -> <<"admin-secret-key-32-bytes-minimum!">>;
+        false -> error({missing_secret, admin_jwt_secret})
+      end;
     S     -> list_to_binary(S)
   end.
 

src/infra/infra_secrets.erl

@@ -0,0 +1,137 @@
+%%%-------------------------------------------------------------------
+%%% @doc Валидация секретов и паролей при старте (EVENTHUB_ENV).
+%%% dev — допускаются documented fallbacks; stage/prod — fail-fast.
+%%% @end
+%%%-------------------------------------------------------------------
+-module(infra_secrets).
+-export([mode/0, is_dev/0, validate_startup/0,
+  require_admin_seed_password/1, require_admin_seed_email/1]).
+
+-define(MIN_SECRET_LEN, 32).
+
+%%%-------------------------------------------------------------------
+%%% API
+%%%-------------------------------------------------------------------
+
+-spec mode() -> dev | stage | prod.
+mode() ->
+  case os:getenv("EVENTHUB_ENV") of
+    false -> dev;
+    Env ->
+      case string:lowercase(Env) of
+        "dev" -> dev;
+        "stage" -> stage;
+        "prod" -> prod;
+        "production" -> prod;
+        _ -> stage
+      end
+  end.
+
+-spec is_dev() -> boolean().
+is_dev() -> mode() =:= dev.
+
+%% @doc Проверка JWT-секретов до поднятия Mnesia/HTTP.
+-spec validate_startup() -> ok | {error, {missing_secret, atom()} | {weak_secret, atom()}}.
+validate_startup() ->
+  case mode() of
+    dev ->
+      dev_warn_if_weak(jwt_secret, effective_jwt_secret()),
+      dev_warn_if_weak(admin_jwt_secret, effective_admin_jwt_secret()),
+      ok;
+    _ ->
+      case require_strong_secret(jwt_secret, effective_jwt_secret()) of
+        ok -> require_strong_secret(admin_jwt_secret, effective_admin_jwt_secret());
+        Err -> Err
+      end
+  end.
+
+-spec require_admin_seed_email(string()) ->
+  {ok, binary()} | {error, {missing_secret, atom()}}.
+require_admin_seed_email(EnvKey) ->
+  case os:getenv(EnvKey) of
+    false -> {error, {missing_secret, list_to_atom(EnvKey)}};
+    "" -> {error, {missing_secret, list_to_atom(EnvKey)}};
+    Email -> {ok, list_to_binary(Email)}
+  end.
+
+-spec require_admin_seed_password(string()) ->
+  {ok, binary()} | {error, {missing_secret, atom()} | {weak_secret, atom()}}.
+require_admin_seed_password(EnvKey) ->
+  case os:getenv(EnvKey) of
+    false -> {error, {missing_secret, list_to_atom(EnvKey)}};
+    "" -> {error, {missing_secret, list_to_atom(EnvKey)}};
+    Pass ->
+      Bin = list_to_binary(Pass),
+      case is_strong_secret(Bin) of
+        true -> {ok, Bin};
+        false -> {error, {weak_secret, list_to_atom(EnvKey)}}
+      end
+  end.
+
+%%%-------------------------------------------------------------------
+%%% Effective values (порядок как в eventhub_auth)
+%%%-------------------------------------------------------------------
+
+effective_jwt_secret() ->
+  effective_secret(jwt_secret, "JWT_SECRET").
+
+effective_admin_jwt_secret() ->
+  effective_secret(admin_jwt_secret, "ADMIN_JWT_SECRET").
+
+effective_secret(AppKey, OsKey) ->
+  case application:get_env(eventhub, AppKey) of
+    {ok, Secret} when is_binary(Secret), byte_size(Secret) > 0 ->
+      case is_placeholder(Secret) of
+        true -> os_getenv_binary(OsKey);
+        false -> Secret
+      end;
+    _ ->
+      os_getenv_binary(OsKey)
+  end.
+
+%%%-------------------------------------------------------------------
+%%% Internal
+%%%-------------------------------------------------------------------
+
+require_strong_secret(Name, undefined) ->
+  {error, {missing_secret, Name}};
+require_strong_secret(Name, Secret) ->
+  case is_strong_secret(Secret) of
+    true -> ok;
+    false -> {error, {weak_secret, Name}}
+  end.
+
+is_strong_secret(Secret) when is_binary(Secret) ->
+  byte_size(Secret) >= ?MIN_SECRET_LEN andalso not lists:member(Secret, denylist()).
+
+is_placeholder(Secret) ->
+  lists:member(Secret, [
+    <<"change_me_in_production">>,
+    <<"${JWT_SECRET:-change_me_in_production}">>,
+    <<"${ADMIN_JWT_SECRET:-change_me_in_production}">>
+  ]).
+
+denylist() -> [
+  <<"123456">>,
+  <<"change_me_in_production">>,
+  <<"eventhub_top_secret">>,
+  <<"user-secret-key-32-bytes-minimum!">>,
+  <<"admin-secret-key-32-bytes-minimum!">>,
+  <<"botpass123">>
+].
+
+os_getenv_binary(Key) ->
+  case os:getenv(Key) of
+    false -> undefined;
+    "" -> undefined;
+    Val -> list_to_binary(Val)
+  end.
+
+dev_warn_if_weak(_Name, undefined) -> ok;
+dev_warn_if_weak(Name, Secret) ->
+  case is_strong_secret(Secret) of
+    true -> ok;
+    false ->
+      io:format("~n[infra_secrets] WARNING: ~p is weak or missing in dev mode; "
+                "runtime fallbacks may apply.~n", [Name])
+  end.

test/unit/infra_secrets_tests.erl

@@ -0,0 +1,62 @@
+-module(infra_secrets_tests).
+-include_lib("eunit/include/eunit.hrl").
+
+-define(STRONG_JWT, <<"this-is-a-strong-user-jwt-secret-32b">>).
+-define(STRONG_ADMIN, <<"this-is-a-strong-admin-jwt-secret32">>).
+
+setup() ->
+  application:load(eventhub),
+  ok.
+
+cleanup(_) ->
+  application:unset_env(eventhub, jwt_secret),
+  application:unset_env(eventhub, admin_jwt_secret),
+  os:unsetenv("EVENTHUB_ENV"),
+  os:unsetenv("JWT_SECRET"),
+  os:unsetenv("ADMIN_JWT_SECRET"),
+  ok.
+
+with_env(Key, Val, Fun) ->
+  os:putenv(Key, Val),
+  try Fun() after os:unsetenv(Key) end.
+
+infra_secrets_test_() ->
+  {foreach, fun setup/0, fun cleanup/1, [
+    {"dev mode allows missing secrets", fun test_dev_missing_ok/0},
+    {"stage rejects missing JWT_SECRET", fun test_stage_missing_jwt/0},
+    {"stage rejects weak JWT_SECRET", fun test_stage_weak_jwt/0},
+    {"stage accepts strong secrets", fun test_stage_strong_ok/0},
+    {"require_admin_seed_password rejects 123456", fun test_weak_admin_password/0}
+  ]}.
+
+test_dev_missing_ok() ->
+  with_env("EVENTHUB_ENV", "dev", fun() ->
+    ?assertEqual(dev, infra_secrets:mode()),
+    ?assertEqual(ok, infra_secrets:validate_startup())
+  end).
+
+test_stage_missing_jwt() ->
+  with_env("EVENTHUB_ENV", "stage", fun() ->
+    ?assertMatch({error, {missing_secret, jwt_secret}},
+      infra_secrets:validate_startup())
+  end).
+
+test_stage_weak_jwt() ->
+  with_env("EVENTHUB_ENV", "stage", fun() ->
+    os:putenv("JWT_SECRET", "123456"),
+    os:putenv("ADMIN_JWT_SECRET", binary_to_list(?STRONG_ADMIN)),
+    ?assertMatch({error, {weak_secret, jwt_secret}},
+      infra_secrets:validate_startup())
+  end).
+
+test_stage_strong_ok() ->
+  with_env("EVENTHUB_ENV", "stage", fun() ->
+    os:putenv("JWT_SECRET", binary_to_list(?STRONG_JWT)),
+    os:putenv("ADMIN_JWT_SECRET", binary_to_list(?STRONG_ADMIN)),
+    ?assertEqual(ok, infra_secrets:validate_startup())
+  end).
+
+test_weak_admin_password() ->
+  os:putenv("ADMIN_PASSWORD", "123456"),
+  ?assertMatch({error, {weak_secret, 'ADMIN_PASSWORD'}},
+    infra_secrets:require_admin_seed_password("ADMIN_PASSWORD")).