fix: close deployment security gaps — secrets, TLS, auto-migrate, image pinning (wd-6ve)

bpamiri · claude · bpamiri · commit fc99d0e457aa · 2026-03-22T15:21:53.000-07:00
1. Secrets out of Docker image: add .dockerignore excluding .env,
   remove .env generation from build job, inject secrets at runtime
   via compose environment + envsubst, add OS env var fallback in
   Application.cfc so the app reads from Docker env when no .env file exists.

2. Portainer TLS verification: remove -k flag from all curl calls
   so MITM attacks against the API key are no longer silently accepted.

3. autoMigrateDatabase=false in production config to prevent
   uncontrolled schema changes on app startup.

4. Pin Docker base image via build ARG with digest resolution in CI;
   remove :latest tag, deploy SHA-tagged images for deterministic deploys.

Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.dockerignore b/.dockerignore
@@ -0,0 +1,29 @@
+# Secrets — NEVER include in image
+.env
+.env.*
+!.env.example
+
+# Git and CI
+.git
+.github
+.gitignore
+
+# IDE and tooling
+.vscode
+.project
+.settings
+.classpath
+.CommandBox
+.claude
+.beads
+.runtime
+
+# Documentation
+*.md
+
+# Tests
+tests/
+
+# Deploy configs (not needed in image)
+deploy/prod/
+deploy/stage/
diff --git a/.github/workflows/swarm-deploy.yml b/.github/workflows/swarm-deploy.yml
@@ -18,60 +18,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Generate .env from secrets
-        env:
-          RELOAD_PASSWORD: ${{ secrets.RELOAD_PASSWORD }}
-          CFCONFIG_ADMIN_PASSWORD: ${{ secrets.CFCONFIG_ADMIN_PASSWORD }}
-          WHEELSDEV_HOST: ${{ secrets.WHEELSDEV_HOST }}
-          WHEELSDEV_PORT: ${{ secrets.WHEELSDEV_PORT }}
-          WHEELSDEV_DATABASENAME: ${{ secrets.WHEELSDEV_DATABASENAME }}
-          WHEELSDEV_USERNAME: ${{ secrets.WHEELSDEV_USERNAME }}
-          WHEELSDEV_PASSWORD: ${{ secrets.WHEELSDEV_PASSWORD }}
-          SMTP_USERNAME: ${{ secrets.SMTP_USERNAME }}
-          SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
-          WHEELS_ID_SALT: ${{ secrets.WHEELS_ID_SALT }}
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+      - name: Resolve base image digest for reproducible builds
         run: |
-          cat > .env << ENVEOF
-          LUCEE_EXTENSIONS=BEC20D47-3268-1B354-C0E8E70B5CBC15A1;name=PostgreSQL;version=42.7.4
-
-          environment=production
-          reloadPassword=${RELOAD_PASSWORD}
-
-          cfconfig_adminPassword=${CFCONFIG_ADMIN_PASSWORD}
-
-          application_host=https://wheels.dev
-          datasource=wheels.dev
-
-          wheelsdev_host=${WHEELSDEV_HOST}
-          wheelsdev_port=${WHEELSDEV_PORT}
-          wheelsdev_databasename=${WHEELSDEV_DATABASENAME}
-          wheelsdev_username=${WHEELSDEV_USERNAME}
-          wheelsdev_password=${WHEELSDEV_PASSWORD}
-          wheelsdev_clob=true
-          wheelsdev_connectionlimit=100
-          wheelsdev_storage=true
-
-          wheelsdev_storage=true
-          sessionStorage=wheels.dev
-          sessionCluster=true
-
-          test_case=false
-          mail_from=noreply@wheels.dev
-
-          smtp_host=smtp.postmarkapp.com
-          smtp_port=587
-          smtp_username=${SMTP_USERNAME}
-          smtp_password=${SMTP_PASSWORD}
-          smtp_ssl=false
-          smtp_tls=true
-
-          wheels_id_salt=${WHEELS_ID_SALT}
-
-          SENTRY_DSN=${SENTRY_DSN}
-          SENTRY_ENVIRONMENT=production
-          ENVEOF
-          sed -i 's/^          //' .env
+          docker pull ortussolutions/commandbox:lucee6
+          DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' ortussolutions/commandbox:lucee6)
+          echo "COMMANDBOX_DIGEST=${DIGEST}" >> "$GITHUB_ENV"
+          echo "Pinned base image: ${DIGEST}"
 
       - name: Copy swarm Dockerfile to root
         run: |
@@ -103,8 +55,9 @@ jobs:
           context: .
           file: ./dockerfile
           push: true
+          build-args: |
+            COMMANDBOX_IMAGE=${{ env.COMMANDBOX_DIGEST }}
           tags: |
-            ${{ env.IMAGE_NAME }}:latest
             ${{ env.IMAGE_NAME }}:${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -128,31 +81,50 @@ jobs:
       - name: Set task history limit
         run: docker swarm update --task-history-limit 2
 
+      - name: Resolve compose file with secrets
+        env:
+          IMAGE_TAG: ${{ github.sha }}
+          RELOAD_PASSWORD: ${{ secrets.RELOAD_PASSWORD }}
+          CFCONFIG_ADMIN_PASSWORD: ${{ secrets.CFCONFIG_ADMIN_PASSWORD }}
+          WHEELSDEV_HOST: ${{ secrets.WHEELSDEV_HOST }}
+          WHEELSDEV_PORT: ${{ secrets.WHEELSDEV_PORT }}
+          WHEELSDEV_DATABASENAME: ${{ secrets.WHEELSDEV_DATABASENAME }}
+          WHEELSDEV_USERNAME: ${{ secrets.WHEELSDEV_USERNAME }}
+          WHEELSDEV_PASSWORD: ${{ secrets.WHEELSDEV_PASSWORD }}
+          SMTP_USERNAME: ${{ secrets.SMTP_USERNAME }}
+          SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
+          WHEELS_ID_SALT: ${{ secrets.WHEELS_ID_SALT }}
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+        run: |
+          envsubst '$IMAGE_TAG $RELOAD_PASSWORD $CFCONFIG_ADMIN_PASSWORD $WHEELSDEV_HOST $WHEELSDEV_PORT $WHEELSDEV_DATABASENAME $WHEELSDEV_USERNAME $WHEELSDEV_PASSWORD $SMTP_USERNAME $SMTP_PASSWORD $WHEELS_ID_SALT $SENTRY_DSN' \
+            < deploy/swarm/docker-compose.yml \
+            > /tmp/docker-compose-resolved.yml
+
       - name: Deploy stack via Portainer API
         env:
           PORTAINER_URL: ${{ secrets.PORTAINER_URL }}
           PORTAINER_API_KEY: ${{ secrets.PORTAINER_API_KEY }}
           PORTAINER_ENDPOINT_ID: ${{ secrets.PORTAINER_ENDPOINT_ID }}
         run: |
-          COMPOSE_CONTENT=$(cat deploy/swarm/docker-compose.yml)
+          COMPOSE_CONTENT=$(cat /tmp/docker-compose-resolved.yml)
 
           # Get the swarm ID from Portainer
-          SWARM_ID=$(curl -sfk \
+          SWARM_ID=$(curl -sf \
             -H "X-API-Key: ${PORTAINER_API_KEY}" \
             "${PORTAINER_URL}/api/endpoints/${PORTAINER_ENDPOINT_ID}/docker/swarm" \
             | jq -r '.ID')
           echo "Swarm ID: ${SWARM_ID}"
 
           # Check if the stack already exists
-          STACK_INFO=$(curl -sfk \
+          STACK_INFO=$(curl -sf \
             -H "X-API-Key: ${PORTAINER_API_KEY}" \
             "${PORTAINER_URL}/api/stacks" \
             | jq -r '.[] | select(.Name == "wheels-dev")')
 
           if [ -n "$STACK_INFO" ]; then
             STACK_ID=$(echo "$STACK_INFO" | jq -r '.Id')
             echo "Updating existing stack (ID: ${STACK_ID})..."
-            HTTP_CODE=$(curl -sk -o /tmp/portainer-response.json -w "%{http_code}" \
+            HTTP_CODE=$(curl -s -o /tmp/portainer-response.json -w "%{http_code}" \
               -X PUT \
               -H "X-API-Key: ${PORTAINER_API_KEY}" \
               -H "Content-Type: application/json" \
@@ -163,7 +135,7 @@ jobs:
               }')")
           else
             echo "Creating new stack..."
-            HTTP_CODE=$(curl -sk -o /tmp/portainer-response.json -w "%{http_code}" \
+            HTTP_CODE=$(curl -s -o /tmp/portainer-response.json -w "%{http_code}" \
               -X POST \
               -H "X-API-Key: ${PORTAINER_API_KEY}" \
               -H "Content-Type: application/json" \
@@ -183,12 +155,14 @@ jobs:
           fi
           echo "Stack deployed successfully via Portainer"
 
-      - name: Force pull latest image
+      - name: Update service to SHA-tagged image
+        env:
+          IMAGE_TAG: ${{ github.sha }}
         run: |
           for i in 1 2 3 4 5; do
             docker service update \
               --with-registry-auth \
-              --image ghcr.io/wheels-dev/wheels-dev:latest \
+              --image "ghcr.io/wheels-dev/wheels-dev:${IMAGE_TAG}" \
               --force \
               wheels-dev_wheels-dev && break
             echo "Attempt $i failed (update out of sequence), retrying in 15s..."
diff --git a/config/production/settings.cfm b/config/production/settings.cfm
@@ -2,8 +2,8 @@
 // Use this file to configure specific settings for the "production" environment.
 // A variable set in this file will override the one in "app/config/settings.cfm".
 
-// Setup automatic migrations
-set(autoMigrateDatabase=true);
+// Disable auto-migration in production — run migrations explicitly in deploy pipeline
+set(autoMigrateDatabase=false);
 
 // Example:
 // set(errorEmailAddress="someone@somewhere.com");
diff --git a/deploy/swarm/docker-compose.yml b/deploy/swarm/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   wheels-dev:
-    image: ghcr.io/wheels-dev/wheels-dev:latest
+    image: ghcr.io/wheels-dev/wheels-dev:${IMAGE_TAG}
     deploy:
       replicas: 3
       restart_policy:
@@ -44,6 +44,34 @@ services:
       PORT: 8888
       HEALTHCHECK_URI: "http://127.0.0.1:8888/"
       BOX_SERVER_JVM_ARGS: "-Xms2g -Xmx3g"
+      # App configuration (non-secret)
+      environment: production
+      application_host: "https://wheels.dev"
+      datasource: "wheels.dev"
+      wheelsdev_clob: "true"
+      wheelsdev_connectionlimit: "100"
+      wheelsdev_storage: "true"
+      sessionStorage: "wheels.dev"
+      sessionCluster: "true"
+      test_case: "false"
+      mail_from: "noreply@wheels.dev"
+      smtp_host: "smtp.postmarkapp.com"
+      smtp_port: "587"
+      smtp_ssl: "false"
+      smtp_tls: "true"
+      SENTRY_ENVIRONMENT: production
+      # Secrets — resolved by envsubst at deploy time
+      reloadPassword: "${RELOAD_PASSWORD}"
+      cfconfig_adminPassword: "${CFCONFIG_ADMIN_PASSWORD}"
+      wheelsdev_host: "${WHEELSDEV_HOST}"
+      wheelsdev_port: "${WHEELSDEV_PORT}"
+      wheelsdev_databasename: "${WHEELSDEV_DATABASENAME}"
+      wheelsdev_username: "${WHEELSDEV_USERNAME}"
+      wheelsdev_password: "${WHEELSDEV_PASSWORD}"
+      smtp_username: "${SMTP_USERNAME}"
+      smtp_password: "${SMTP_PASSWORD}"
+      wheels_id_salt: "${WHEELS_ID_SALT}"
+      SENTRY_DSN: "${SENTRY_DSN}"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://127.0.0.1:8888/"]
       interval: 30s
diff --git a/deploy/swarm/dockerfile b/deploy/swarm/dockerfile
@@ -1,4 +1,7 @@
-FROM ortussolutions/commandbox:lucee6
+# Pin base image — pass --build-arg to override with digest for reproducible builds
+# Resolve digest: docker pull ortussolutions/commandbox:lucee6 && docker inspect --format='{{index .RepoDigests 0}}' ortussolutions/commandbox:lucee6
+ARG COMMANDBOX_IMAGE=ortussolutions/commandbox:lucee6
+FROM ${COMMANDBOX_IMAGE}
 
 # Install PostgreSQL JDBC extension for CockroachDB connectivity
 ENV LUCEE_EXTENSIONS="BEC20D47-3268-1B354-C0E8E70B5CBC15A1;name=PostgreSQL;version=42.7.4"
diff --git a/public/Application.cfc b/public/Application.cfc
@@ -86,6 +86,17 @@ component output="false" {
 			}
 		}
 		
+		// Fall back to OS environment variables for keys not set by .env files
+		// This enables Docker Swarm deployments to inject config via compose environment:
+		try {
+			local.osEnv = createObject("java", "java.lang.System").getenv();
+			for (local.envKey in local.osEnv) {
+				if (!structKeyExists(this.env, local.envKey)) {
+					this.env[local.envKey] = local.osEnv[local.envKey];
+				}
+			}
+		} catch (any e) {}
+
 		// Perform variable interpolation
 		performVariableInterpolation(this.env);
 	}

Original file line number	Diff line number	Diff line change
`@@ -86,6 +86,17 @@ component output="false" {`
`86`	`86`	`}`
`87`	`87`	`}`
`88`	`88`
	`89`	`+ // Fall back to OS environment variables for keys not set by .env files`
	`90`	`+ // This enables Docker Swarm deployments to inject config via compose environment:`
	`91`	`+ try {`
	`92`	`+ local.osEnv = createObject("java", "java.lang.System").getenv();`
	`93`	`+ for (local.envKey in local.osEnv) {`
	`94`	`+ if (!structKeyExists(this.env, local.envKey)) {`
	`95`	`+ this.env[local.envKey] = local.osEnv[local.envKey];`
	`96`	`+ }`
	`97`	`+ }`
	`98`	`+ } catch (any e) {}`
	`99`	`+`
`89`	`100`	`// Perform variable interpolation`
`90`	`101`	`performVariableInterpolation(this.env);`
`91`	`102`	`}`