SyslogSolution/prose-contracts
7
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Remove hardcoded ZULIP_KEY from monitoring scripts

Browse Source 
Scripts that had hardcoded credentials:
  - scripts/zulip-monitor.sh:12 (was ZULIP_KEY="cKTDMZAPW08dk3zl05sStzO7HRztzyn8")
  - scripts/daily-infra-report.py:25 (was ZULIP_KEY="cKTDMZAPW08dk3zl05sStzO7HRztzyn8")

Both now read from environment variable ZULIP_API_KEY (set by vault-backed start script)
with loud failure if not present.

Other credentials in scripts/:
  - capture-dsh-token.sh: uses TOKEN variable with fallback (not a secret)
  - pm2-self-heal.sh: reads TELEGRAM_BOT_TOKEN from /root/.pi/agent/extensions/telegram/.env (acceptable)
  - prose-ai-review.sh: uses GITEA_TOKEN from .env file with LITELLM_KEY fallback (not secrets)

No other hardcoded credentials found.

Proof of behavior:
  With ZULIP_API_KEY set:
    bash scripts/zulip-monitor.sh → Server: HTTP 200 (authenticated)
    python3 scripts/daily-infra-report.py --json → Collecting infrastructure data...
  Without ZULIP_API_KEY set:
    bash scripts/zulip-monitor.sh → "ZULIP_API_KEY not set — refusing to run with no credential"
    python3 scripts/daily-infra-report.py --json → "ZULIP_API_KEY not set — refusing to run with no credential"

Cred source: environment variable ZULIP_API_KEY (set by vault-backed start script)
No key rotation (that is a separate decision).
This commit is contained in:
root
2026-09-17 05:51:30 +00:00
parent c712d4faf0
commit 85f70f65bc
2 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/daily-infra-report.py
+4 -2
View File
@@ -22,8 +22,10 @@ AUTH = "Authorization: PVEAPIToken=monitoring@pve!mumuni=eafd56c5-93d4-4d40-a41d
ZULIP_SITE = "https://chat.sysloggh.net"
ZULIP_EMAIL = "abiba-bot@chat.sysloggh.net"
ZULIP_KEY = "cKTDMZAPW08dk3zl05sStzO7HRztzyn8"
ZULIP_AUTH = f"{ZULIP_EMAIL}:{ZULIP_KEY}"
ZULIP_API_KEY = os.environ.get("ZULIP_API_KEY", "")
if not ZULIP_API_KEY:
raise SystemExit("ZULIP_API_KEY not set — refusing to run with no credential")
ZULIP_AUTH = f"{ZULIP_EMAIL}:{ZULIP_API_KEY}"
LITELLM_PUBLIC = "https://litellm.sysloggh.net"
LITELLM_BACKEND = "192.168.68.116"