Configure kredits-github #37

raucao · 2019-04-19T17:47:03Z

raucao commented

2019-04-19 17:47:03 +00:00

This is running on barnard.kosmos.org, but for some reason that I can't figure out nginx just refuses connections to the site. All configs and services look good to me, and nothing is throwing errors.

closes #35

This is running on `barnard.kosmos.org`, but for some reason that I can't figure out nginx just refuses connections to the site. All configs and services look good to me, and nothing is throwing errors. closes #35

raucao changed title from ~~Configure kosmos-github~~ to Configure kredits-github

2019-04-19 17:49:17 +00:00

raucao commented

2019-04-19 17:50:00 +00:00

Sorry, the commit has the wrong app name.

raucao commented

2019-04-20 08:26:32 +00:00

I fixed the issue. All working now.

greg commented

2019-04-23 08:40:36 +00:00

As the environment contains secret I'm switching the systemd unit to use EnvironmentFile instead.

LGTM apart from that and the references to sockethub that I fixed.

As the environment contains secret I'm switching the systemd unit to use [EnvironmentFile](https://coreos.com/os/docs/latest/using-environment-variables-in-systemd-units.html#environmentfile-directive) instead. LGTM apart from that and the references to sockethub that I fixed.

greg changed title from ~~Configure kredits-github~~ to WIP: Configure kredits-github

2019-04-23 08:40:43 +00:00

raucao commented

2019-04-23 08:48:40 +00:00

As the environment contains secret I’m switching the systemd unit to use EnvironmentFile instead.

I cannot see how that makes it more secure from the document you linked. Care to explain?

(I assume this comes from me pasting a sentence from and link to the official systemd docs, where it says you shouldn't put secrets in systemd environment vars?)

Also, wouldn't we need to do that for all our cookbooks/systemd units then? (Meaning there's an issue missing about it.)

> As the environment contains secret I’m switching the systemd unit to use EnvironmentFile instead. I cannot see how that makes it more secure from the document you linked. Care to explain? (I assume this comes from me pasting a sentence from and link to the official systemd docs, where it says you shouldn't put secrets in systemd environment vars?) Also, wouldn't we need to do that for *all* our cookbooks/systemd units then? (Meaning there's an issue missing about it.)

greg commented

2019-04-23 12:11:55 +00:00

I checked, it turns out I misunderstood EnvironmentFile. Using it I thought it wouldn't show the environment variables in /proc/$ID/environ, but that can only be read by root, not regular users. So we can use Environment directives, as long as the systemd unit file is not world readable (so the unit file itself to be something like 640)

I think every systemd unit file that contains secrets shouldn't be world readable, we can create an issue about it

I have also found this regarding EnvironmentFile, Poettering said it was a mistake: https://unix.stackexchange.com/a/419061

I checked, it turns out I misunderstood EnvironmentFile. Using it I thought it wouldn't show the environment variables in `/proc/$ID/environ`, but that can only be read by root, not regular users. So we can use Environment directives, as long as the systemd unit file is not world readable (so the unit file itself to be something like 640) I think every systemd unit file that contains secrets shouldn't be world readable, we can create an issue about it I have also found this regarding `EnvironmentFile`, Poettering said it was a mistake: https://unix.stackexchange.com/a/419061

greg commented

2019-04-23 12:21:16 +00:00

I reverted my EnvironmentFile change and fixed the permission in 2cf6112

I reverted my `EnvironmentFile` change and fixed the permission in 2cf6112

raucao commented

2019-04-23 12:34:42 +00:00

OK, but that still doesn't explain why this one cookbook would be the only one where we have to solve the problem. I merely did what we do in literally all of our site cookbooks.

Also, that still leaves the question about env vars in systemd units being unsecure for other reasons than reading the file itself, as outlined by the systemd docs I linked.

OK, but that still doesn't explain why this one cookbook would be the only one where we have to solve the problem. I merely did what we do in literally all of our site cookbooks. Also, that still leaves the question about env vars in systemd units being unsecure for other reasons than reading the file itself, as outlined by the systemd docs I linked.

greg commented

2019-04-23 12:53:48 +00:00

Can you link that page again? I can't find it

Edit: I created #38 for the Systemd environment variables

Can you link that page again? I can't find it Edit: I created #38 for the Systemd environment variables

raucao changed title from ~~WIP: Configure kredits-github~~ to Configure kredits-github

2019-04-24 16:55:25 +00:00

greg closed this pull request

2019-04-25 14:03:15 +00:00

greg deleted branch feature/35-kredits_github

2019-04-25 14:03:21 +00:00

Sign in to join this conversation.

No reviewers

No Milestone

No project

No Assignees

2 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: kosmos/chef#37