coulomb/canned-prompts
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Read credentials from files, not only the environment

Browse source 
Found by packaging the service for Railiance (rapp-canned-prompts). Every other
rapp in the fleet mounts its database credential as a file; this service could
only read CANNED_PROMPTS_DATABASE_URL from the environment, which would have
put a database password into kubectl describe, into crash dumps, and in reach
of anything able to read /proc.

Adds CANNED_PROMPTS_DATABASE_URL_FILE and CANNED_PROMPTS_PUBLISH_TOKEN_FILE. A
mounted secret stays a file. When both forms are set the file wins, because a
rotated secret must take effect rather than be shadowed by a stale env var, and
an unreadable secret file fails loudly rather than falling back to a value that
may be older.

Service tests 33 -> 36.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
This commit is contained in:
tegwick 2026-09-06 21:45:29 +02:00
parent cb133f3673
commit 0fb7150956
6 changed files with 79 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
workplans/CANP-WP-0006-hosted-registry-service.md
View file

@ -283,7 +283,19 @@ credentials, and outward-facing enough that it is not mine to take unasked.
## Follow-on: rapp-canned-prompts
Not a task in this workplan; recorded so the sequence is not lost.
`rapp-canned-prompts` now exists, is registered (agents / practice, prefix
`RCP-WP`), and carries its declaration, manifests and smoke tooling.
`RCP-WP-0002` holds the remaining steps.
**Packaging it surfaced a gap in this service.** The deployment mounts
credentials as files, as the fleet's other rapps do, but the service only read
`CANNED_PROMPTS_DATABASE_URL` from the environment — which would have put a
database password into `kubectl describe`, crash dumps, and anything able to
read `/proc`. Added `CANNED_PROMPTS_DATABASE_URL_FILE` and
`CANNED_PROMPTS_PUBLISH_TOKEN_FILE`; the file form wins when both are set, so a
rotated secret takes effect instead of being shadowed. Service tests 33 → 36.
Recorded so the sequence is not lost.
1. Publish the image to the fleet registry and capture its digest.
2. Create `rapp-canned-prompts` with `ownership_repo: canned-prompts`,