psa-systems/bunyip
Watch
9
0
Fork
You've already forked bunyip
 0
Code Issues Pull requests Projects Releases 18 Packages Wiki Activity Actions

fix(deploy): require OIDC signing-key vars; refuse to boot under a dev-* kid in prod #275

Merged
YousifShkara merged 1 commit from fix/BUNYIP-258-drop-dev-signing-key-defaults into main 2026-06-30 06:29:08 +02:00
Conversation 0 Commits 1 Files changed 3 +35 -2
YousifShkara commented 2026-06-30 04:28:42 +02:00
Owner
Copy link

BUNYIP-258: compose.yml previously defaulted OIDC_JWT_PRIVATE_KEY_PATH=/run/secrets/oidc/dev-2026.pem and OIDC_JWT_ACTIVE_KID=dev-2026. A fresh production deploy that forgot to override either env silently signed every id_token and at+jwt with a dev-named kid pointing at a dev key path. Downstream RPs would happily consume kid=dev-2026 tokens because their JWKS lookup is keyed on whatever the OP advertises - the misconfiguration only surfaces when someone notices the kid name.

Two defenses:

  • compose.yml: replace the defaults with ${VAR:?message} so compose up aborts when either var is unset. Mirrors the BUNYIP-237 posture for BUNYIP_API_IMAGE / BUNYIP_WEB_IMAGE.
  • bunyip-api/main.rs: panic at boot when ENVIRONMENT=production and OIDC_JWT_ACTIVE_KID starts with dev- (case-insensitive). Catches the paste-error case where an operator filled the var with a leftover dev value.

.env.example updated to document the new requirement. compose.dev.yml sets both values explicitly (/run/secrets/oidc/dev-2026.pem, dev-2026) so just dev continues to work without any further change; the panic only fires under ENVIRONMENT=production.

#BUNYIP-258

BUNYIP-258: compose.yml previously defaulted `OIDC_JWT_PRIVATE_KEY_PATH=/run/secrets/oidc/dev-2026.pem` and `OIDC_JWT_ACTIVE_KID=dev-2026`. A fresh production deploy that forgot to override either env silently signed every id_token and at+jwt with a dev-named kid pointing at a dev key path. Downstream RPs would happily consume `kid=dev-2026` tokens because their JWKS lookup is keyed on whatever the OP advertises - the misconfiguration only surfaces when someone notices the kid name. Two defenses: - `compose.yml`: replace the defaults with `${VAR:?message}` so `compose up` aborts when either var is unset. Mirrors the BUNYIP-237 posture for `BUNYIP_API_IMAGE` / `BUNYIP_WEB_IMAGE`. - `bunyip-api/main.rs`: panic at boot when `ENVIRONMENT=production` and `OIDC_JWT_ACTIVE_KID` starts with `dev-` (case-insensitive). Catches the paste-error case where an operator filled the var with a leftover dev value. `.env.example` updated to document the new requirement. `compose.dev.yml` sets both values explicitly (`/run/secrets/oidc/dev-2026.pem`, `dev-2026`) so `just dev` continues to work without any further change; the panic only fires under `ENVIRONMENT=production`. #BUNYIP-258
fix(deploy): require OIDC signing-key vars; refuse to boot under a dev-* kid in prod
All checks were successful
Check / fmt + clippy + build + tests (pull_request) Successful in 8m44s
Details
E2E / Playwright against deployment (pull_request) Successful in 23s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
611df32898 
BUNYIP-258: compose.yml previously defaulted `OIDC_JWT_PRIVATE_KEY_PATH=/run/secrets/oidc/dev-2026.pem` and `OIDC_JWT_ACTIVE_KID=dev-2026`. A fresh production deploy that forgot to override either env silently signed every id_token and at+jwt with a dev-named kid pointing at a dev key path. Downstream RPs would happily consume `kid=dev-2026` tokens because their JWKS lookup is keyed on whatever the OP advertises - the misconfiguration only surfaces when someone notices the kid name.

Two defenses:

- `compose.yml`: replace the defaults with `${VAR:?message}` so `compose up` aborts when either var is unset. Mirrors the BUNYIP-237 posture for `BUNYIP_API_IMAGE` / `BUNYIP_WEB_IMAGE`.
- `bunyip-api/main.rs`: panic at boot when `ENVIRONMENT=production` and `OIDC_JWT_ACTIVE_KID` starts with `dev-` (case-insensitive). Catches the paste-error case where an operator filled the var with a leftover dev value.

`.env.example` updated to document the new requirement. `compose.dev.yml` sets both values explicitly (`/run/secrets/oidc/dev-2026.pem`, `dev-2026`) so `just dev` continues to work without any further change; the panic only fires under `ENVIRONMENT=production`.

#BUNYIP-258
YousifShkara deleted branch fix/BUNYIP-258-drop-dev-signing-key-defaults 2026-06-30 06:29:08 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
YousifShkara
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/bunyip!275
No description provided.