vh
b6340519bc
Session captured for a context reset. Six new detail entries. THE OPEN ITEM: Anaheim's IPsec tunnel delivers ~550 Mbit/s aggregate against a circuit measured at 2,153 Mbit/s. Not WireGuard (it is IPsec on ana-gw), not CPU (idle), not crypto exhaustion (NPU-offloaded), not the fibre. Both tunnels negotiate aes256-sha1; AES-GCM proposed. Operator signalled authorization; execution pending, untracked by operator choice. Also recorded: selene retired after losing a head-to-head on its own job with chat-judge moved to gen and the model name left to 404; the 7-alias collision on the gen seat that makes cross-alias corroboration an echo; hrafn adopted and its CI found to have been reporting green while deploying nothing for its whole life; all three Worldtree instances de-armed from a 69-day-stale :latest and the Matrix homeserver re-plumbed to personal; every secret-bearing .env on ana-docker tightened to 0600; the pfi org closing the repo-creation half of the credential-migration directive; booth kept-board deletion and link pruning. Two entries under Tried and abandoned: the CI checkout assertion that broke the pipeline twice and was removed, and my proposal to alias a retired model name at a different model, which the operator correctly overruled. Index 271 -> 282 lines, under the 300 cap, so no archival fired.
1.8 KiB
[2026-08-23] Every secret-bearing .env on ana-docker tightened to 0600
Found while taking uptime ownership of hrafn: its .env was mode 0644 with a live
bearer token. Not a hrafn lapse — 0644 was the de facto pattern on the host.
Eight stacks carried secret-shaped vars in world-readable .env files on a box with
four interactive accounts, verified as real exposure by reading one as nobody.
Swept: vaultwarden, traefik, beszel, gitea-runner, miniflux, news-digest,
searxng, vor. (hrafn and nevermore were fixed separately the same day.) Six other
stacks already used 0600, so this converged on the existing house pattern rather
than inventing one. Post-sweep the host has zero secret-bearing .env readable
by nobody.
Playbook: playbooks/tighten-env-perms.yaml, one run per stack, re-runnable.
The check that matters
Every run asserts docker compose config still renders as the deploy user
(lkraven), not as root. Checking the mode proves the bits changed; only rendering
as the deploy user proves the next deploy can still resolve its variables.
Two gotchas recorded in the playbook
- vaultwarden looked like it bind-mounted its
.env— which would mean the container's UID reads it and 0600 could break the password vault. It does not: that- .envis underenv_file:, notvolumes:. My grep matched the YAML list item without checking its parent key. The playbook now refuses any stack that genuinely bind-mounts its.env, since that case is read by the container UID. - elway prompted for a sudo password. The
ana-dockerssh alias resolves tolkraven, who needs one;infra-ops@10.250.50.70has NOPASSWD.corviduo-devwas repointed to infra-ops at some point andana-dockerwas not. Run elway against the infra-ops target on this host.
Commit a896c0a.