stwaidele/dorfteich
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 22 Wiki Activity

[VS-NfD] Verify that no real .env is shipped and document the example as authoritative #198

New Issue
Closed
opened 2026-07-30 01:43:34 +02:00 by fable-5 · 1 comment
fable-5 commented 2026-07-30 01:43:34 +02:00
Collaborator
Copy Link

Plan reference: 20-massnahmenplan.md -> Phase 2
ADR: n/a
Effort: S (0,5 AT)
Depends on: —

Context

The plan suspected a real .env in the repository. Verification shows it
is not tracked — the remaining work is to make that verifiable and keep
it that way, which is what an assessor actually asks for.

Current state

  • deploy/compose/.env exists in the working tree but is not tracked:
    .gitignore:5–7 excludes .env and .env.* while allowing
    .env.example; git ls-files deploy/compose/ lists only
    .env.example, Caddyfile, compose.dev.yml, docker-compose.yml.
  • deploy/compose/.env.example is present and maintained.

Acceptance criteria

  • A CI check fails if any .env (other than .env.example) is ever
    tracked, and if a tracked file matches obvious secret patterns.
  • .env.example documents every variable the compose files reference,
    including the ones added by #188, #190, #191 and #192.
  • The git history is checked once for previously committed secrets, and
    the result recorded in the residual-risk list (#231) — either "none
    found" or the concrete finding.
  • docs/self-hosting/README.md states that .env.example is the
    reference and real values never enter the repository.

Out of scope

Introducing a secret manager, and rotating existing secrets.

**Plan reference:** `20-massnahmenplan.md` -> Phase 2 **ADR:** n/a **Effort:** S (0,5 AT) **Depends on:** — ## Context The plan suspected a real `.env` in the repository. Verification shows it is **not** tracked — the remaining work is to make that verifiable and keep it that way, which is what an assessor actually asks for. ## Current state - `deploy/compose/.env` exists in the working tree but is **not** tracked: `.gitignore:5–7` excludes `.env` and `.env.*` while allowing `.env.example`; `git ls-files deploy/compose/` lists only `.env.example`, `Caddyfile`, `compose.dev.yml`, `docker-compose.yml`. - `deploy/compose/.env.example` is present and maintained. ## Acceptance criteria - [ ] A CI check fails if any `.env` (other than `.env.example`) is ever tracked, and if a tracked file matches obvious secret patterns. - [ ] `.env.example` documents every variable the compose files reference, including the ones added by #188, #190, #191 and #192. - [ ] The git history is checked once for previously committed secrets, and the result recorded in the residual-risk list (#231) — either "none found" or the concrete finding. - [ ] `docs/self-hosting/README.md` states that `.env.example` is the reference and real values never enter the repository. ## Out of scope Introducing a secret manager, and rotating existing secrets.
fable-5 added this to the M24 — VS-NfD: security quick wins milestone 2026-07-30 01:43:34 +02:00
fable-5 added the
effort:S
vs-nfd
area:supply-chain
 labels 2026-07-30 01:43:34 +02:00
fable-5 commented 2026-07-30 22:00:15 +02:00
Author
Collaborator
Copy Link

Implemented in PR #253 (commit ff842f9, CI run 507 green, fast-forward merged into main on Stefan's explicit go-ahead).

Evidence:

  • One-time history check: only tracked .env* path ever was deploy/compose/.env.example; 0 hits for secret patterns across all added lines (details in comment on #231).
  • New early CI step 'No tracked .env files or secret material' in the checks job; tested positive and negative locally.
  • .env.example verified complete against compose ${VAR} refs; README notes .env.example as authoritative.
  • Plan checkbox in docs/vs-nfd/20-massnahmenplan.md ticked in the PR.
Implemented in PR #253 (commit ff842f9, CI run 507 green, fast-forward merged into main on Stefan's explicit go-ahead). Evidence: - One-time history check: only tracked .env* path ever was deploy/compose/.env.example; 0 hits for secret patterns across all added lines (details in comment on #231). - New early CI step 'No tracked .env files or secret material' in the checks job; tested positive and negative locally. - .env.example verified complete against compose ${VAR} refs; README notes .env.example as authoritative. - Plan checkbox in docs/vs-nfd/20-massnahmenplan.md ticked in the PR.
fable-5 referenced this issue from a commit 2026-07-31 10:01:14 +02:00
#231: residual-risk list
fable-5 referenced this issue from a commit 2026-07-31 10:35:39 +02:00
#231: residual-risk list
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
area:auth

   
area:docs

   
area:export

   
area:ops

   
area:storage

   
area:supply-chain

   
auth

Authentication, permissions, quotas

  
backend

API server (apps/api)

  
blocked

Blocked on external dependency/infrastructure

  
collab

Collaboration server (apps/collab)

  
deployment

Docker, CI/CD, hosting

  
docs

Documentation

  
effort:L

   
effort:M

   
effort:S

   
frontend

SPA (apps/web)

  
plugins

Plugin system and SDK

  
qa

Tests, fixtures, e2e

  
vs-nfd

   
vs-nfd:blocker
No Label
area:auth
area:docs
area:export
area:ops
area:storage
area:supply-chain
auth
backend
blocked
collab
deployment
docs
effort:L
effort:M
effort:S
frontend
plugins
qa
vs-nfd
vs-nfd:blocker
Milestone
Clear milestone
No items
No Milestone
M24 — VS-NfD: security quick wins
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#198
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?