greeneclipse
8580c996c3
Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.
2.1 KiB
2.1 KiB
Security and operational runbook
Grounded in docs/security-notes.md and docs/ops-runtime.md.
Controls in place
| Area | Control |
|---|---|
| CSRF | Double-submit cookie + X-CSRF-Token on dashboard /api/* (skipped for /api/v1, /api/public/*, webhooks) |
| Sessions | scs + Postgres store; HttpOnly; idle SESSION_IDLE_HOURS (default 24); absolute 7d |
| CORS | Allowlist = WEB_ORIGIN only; credentials allowed |
| SSRF | Feed + Woo URL checks; Shopify *.myshopify.com; optional FEED_URL_PRIVATE_ALLOWLIST / settings allowlist |
| Uploads | CSV/logo size + type caps under UPLOAD_DIR/{company_id}/ |
| AuthZ | Session company context; API key company binding; admin vs support_staff |
| Rate limits | Auth POSTs / IP; process/sync/export / company (in-process — not cluster-global) |
Ops runbook
flowchart LR
Deploy --> Migrate["scripts/migrate.ps1 / goose up"]
Migrate --> API[cmd/api]
Migrate --> Worker[cmd/worker]
API --> Probes["/healthz /readyz"]
Worker --> Probes
Probes --> Hypercare["/api/admin/readiness + diagnostics"]
- Bring up: Docker Postgres → migrate → API + worker → web.
- Probes: /healthz no DB; /readyz pings Postgres and reports maintenance/read_only.
- Maintenance: MAINTENANCE_MODE / READ_ONLY_MODE — keep probes green during cutover rehearsal.
- Mail: Platform invites need SMTP_ENABLED + host/from; tenant marketing mail is separate.
- Credentials: Set APP_ENCRYPTION_KEY before storing production Woo/AI secrets; rotating without re-save breaks ciphertext.
- Stuck jobs: diagnostics → stuck-cleanup → retry; ensure worker is running.
- Support auto-reply: default off (enabled=false); publish KB + raise threshold before enabling FAQ; AI needs support role configured.
- Never log: Stripe/OpenAI/SMTP/Woo/Shopify/EPREL secrets.
Known residual risks (honest)
In-process rate limits do not cluster; broad private feed allowlists re-enable SSRF; public export tokens rely on entropy; demo API keys are local-only.
For cutover blockers and SMTP verification, see docs/ops-runtime.md and docs/production-checklist.md.