nessi/NexaPG
1
0
Fork 0
Code Issues 16 Pull Requests Actions Packages Projects Releases 14 Activity

[NX-204 Issue] Add secret management guidelines and enhance security notes
Some checks are pending
Container CVE Scan (development) / Scan backend/frontend images for CVEs (push) Waiting to run
Details
Migration Safety / Alembic upgrade/downgrade safety (push) Successful in 2m43s
Details
PostgreSQL Compatibility Matrix / PG14 smoke (push) Successful in 8s
Details
PostgreSQL Compatibility Matrix / PG15 smoke (push) Successful in 8s
Details
PostgreSQL Compatibility Matrix / PG16 smoke (push) Successful in 8s
Details
PostgreSQL Compatibility Matrix / PG17 smoke (push) Successful in 7s
Details
PostgreSQL Compatibility Matrix / PG18 smoke (push) Successful in 7s
Details
Proxy Profile Validation / validate (push) Successful in 3s
Details
Python Dependency Security / pip-audit (block high/critical) (push) Successful in 26s
Details
Docker Publish (Release) / Build and Push Docker Images (release) Successful in 1m41s
Details

Browse Source 
Introduced a comprehensive guide for secure production secret handling (`docs/security/secret-management.md`). Updated `.env.example` files with clearer comments on best practices, emphasizing not hardcoding secrets and implementing rotation strategies. Enhanced README with a new section linking to the secret management documentation.
This commit is contained in:
Sascha Nesterovic
2026-02-15 12:29:40 +01:00
parent f25792b8d8
commit 597579376f
4 changed files with 96 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ops/.env.example
View File

@@ -12,6 +12,7 @@ LOG_LEVEL=INFO
# Core Database (internal metadata DB)
# ------------------------------
# Database that stores users, targets, metrics, query stats, and audit logs.
# DEV default only. Use strong unique credentials in production.
DB_NAME=nexapg
DB_USER=nexapg
DB_PASSWORD=nexapg
@@ -23,7 +24,7 @@ DB_PORT=5433
# ------------------------------
# Host port mapped to backend container port 8000.
BACKEND_PORT=8000
# JWT signing secret. Change this in every non-local environment.
# JWT signing secret. Never hardcode in source. Rotate regularly.
JWT_SECRET_KEY=change_this_super_secret
JWT_ALGORITHM=HS256
# Access token lifetime in minutes.
@@ -31,6 +32,7 @@ JWT_ACCESS_TOKEN_MINUTES=15
# Refresh token lifetime in minutes (10080 = 7 days).
JWT_REFRESH_TOKEN_MINUTES=10080
# Key used to encrypt monitored target passwords at rest.
# Never hardcode in source. Rotate with re-encryption plan.
# Generate with:
# python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
ENCRYPTION_KEY=REPLACE_WITH_FERNET_KEY