Skip to content

Harden Docker defaults for admin bootstrap and secrets #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pparage wants to merge 1 commit into from
Closed

Harden Docker defaults for admin bootstrap and secrets #93

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,13 @@ prepare_db() {
flask db_init
flask db upgrade
flask import_licenses_from_spdx
flask create_admin --login admin --email admin@admin.localhost --password password || true

if [ -n "${MOSP_ADMIN_PASSWORD:-}" ]; then
flask create_admin \
--login "${MOSP_ADMIN_LOGIN:-admin}" \
--email "${MOSP_ADMIN_EMAIL:-admin@admin.localhost}" \
--password "$MOSP_ADMIN_PASSWORD" || true
fi
}

# waiting for DB to come up
Expand Down
5 changes: 3 additions & 2 deletions instance/docker.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
#!/usr/bin/env python
import os
import secrets

# Webserver
HOST = os.getenv("HOST", "0.0.0.0")
Expand Down Expand Up @@ -27,8 +28,8 @@
)
SQLALCHEMY_TRACK_MODIFICATIONS = os.getenv("SQLALCHEMY_TRACK_MODIFICATIONS", "0") == "1"

SECRET_KEY = "LCx3BchmHRxFzkEv4BqQJyeXRLXenf"
SECURITY_PASSWORD_SALT = "L8gTsyrpRQEF8jNWQPyvRfv7U5kJkD"
SECRET_KEY = os.getenv("SECRET_KEY", secrets.token_urlsafe(32))
SECURITY_PASSWORD_SALT = os.getenv("SECURITY_PASSWORD_SALT", secrets.token_urlsafe(32))
Comment on lines +31 to +32
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Generate stable secret defaults across workers

SECRET_KEY and SECURITY_PASSWORD_SALT are now generated with secrets.token_urlsafe(32) at import time, so each Gunicorn worker gets different values when env vars are unset. In this repo the entrypoint launches gunicorn --workers 2, so session cookies/CSRF tokens issued by one worker are invalid on requests handled by the other, causing intermittent logouts and form failures in the default Docker deployment. The fallback needs to be process-stable (shared env/file/derived once before workers) rather than per-worker random generation.

Useful? React with 👍 / 👎.


LOG_PATH = "./var/log/mosp.log"
LOG_LEVEL = "info"
Expand Down
Loading