docs: correct credential guidance left stale by #595 and #607 - #610
Conversation
The hardening page still told operators to edit MinIO credentials directly in docker-compose.yml and to set SPRING_DATASOURCE_PASSWORD — a variable that exists nowhere in the codebase. It also listed the Keycloak admin default as user / P@ssw0rd, which #607 removed: the prod overlays now abort instead. Following that page after those two PRs would have produced a deployment that either fails to start or leaves credentials unchanged in a file that is no longer the place to change them. Rewrites the section around .env, lists every required variable, and documents the POSTGRES_USER/POSTGRES_DB first-init caveat that otherwise only surfaces as a startup failure on an existing volume. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 52 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughProduction and deployment documentation now requires ChangesProduction credential hardening
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/operations/production-hardening.rst`:
- Around line 51-53: Update the production-hardening documentation around the
“Those defaults are public” statement to clarify that credential presence checks
only reject unset values, not known defaults. State that operators must replace
values such as tracepcap_pass and minioadmin in .env with unique production
secrets.
- Around line 72-77: Update the existing-volume caveat in the production
hardening documentation to cover POSTGRES_PASSWORD as well as POSTGRES_USER and
POSTGRES_DB, including that changing it does not update the existing role
password and requires password rotation guidance; keep the existing
initialization and data-preservation warnings accurate.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: bbde0553-dcfb-47bf-9097-cf786581dad5
📒 Files selected for processing (1)
docs/operations/production-hardening.rst
Addresses review on #610. - Presence checks only reject UNSET values, not known-bad ones. The page implied the overlays prevent public defaults; an operator can still write tracepcap_pass into .env and it starts fine. Says so now. - POSTGRES_PASSWORD carries the same first-init-only caveat as POSTGRES_USER and POSTGRES_DB, which the warning omitted. Verified empirically: recreating a container with a changed password against an existing volume leaves the OLD password active and silently ignores the new one (the new one fails authentication from a remote client; localhost hides this behind trust auth). That is the more dangerous case — the deployment looks like it accepted a rotated credential. Added ALTER ROLE as the fix. - Documented POSTGRES_USER=tracepcap, but the real default everywhere else is tracepcap_user. Copying that block against an existing volume would trigger exactly the failure the adjacent warning describes. Corrected, and the first-init-only values are now flagged inline. - The PR claimed no stale references remained; that held only for the file it touched. Fixed the same P@ssw0rd guidance in user-management.rst and offline-deployment.rst, and removed SPRING_DATASOURCE_PASSWORD from the environment-variables reference table — the variable exists nowhere in the codebase, and that table is where someone looks a variable up. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/operations/production-hardening.rst`:
- Around line 96-99: Update the password-rotation example to avoid passing the
new password through the ALTER ROLE command line. Show an interactive psql
session using \password <user>, or another secret-safe mechanism that prevents
exposure in shell history and process listings.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ddf7c00c-308e-4695-8acf-a47db1bb6719
📒 Files selected for processing (4)
docs/configuration/environment-variables.rstdocs/configuration/user-management.rstdocs/getting-started/offline-deployment.rstdocs/operations/production-hardening.rst
The ALTER ROLE example added in the previous commit put the new password on the command line, exposing it in shell history and the process list — and, since ALTER ROLE ... WITH PASSWORD sends plaintext, in the server log too. Replaced with psql's \password meta-command, which prompts for the value and sends it pre-hashed. Verified the documented procedure end to end: rotated a password via \password against a live container, then confirmed over the network that the new password authenticates and the old one is rejected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 participant
Problem
docs/operations/production-hardening.rstwas not updated alongside the two credential PRs, so following it now produces a broken or insecure deployment:MINIO_ROOT_USER/MINIO_ROOT_PASSWORDindocker-compose.yml.env; editing compose is no longer the mechanismSPRING_DATASOURCE_PASSWORDto matchDATABASE_PASSWORD, and it is already wired fromPOSTGRES_PASSWORDuser/P@ssw0rdKEYCLOAK_ADMIN*is unsetAn operator following the page would either leave credentials unchanged in a file that no longer drives them, or set a variable nothing reads.
Changes
.env, listing every required variable with the MinIO 8-character minimum.*-prod.ymloverlays require every credential and abort otherwise.analyst/analystapp login does still exist and still needs changing.Added: the caveat that only shows up as a startup failure
POSTGRES_USERandPOSTGRES_DBapply only on first volume init. Setting them against an existing deployment does not rename the role or database — Postgres keeps the old ones while the backend connects with the new, and startup fails.This was documented in
.env.examplebut not on the page an operator reads when hardening a running box, which is exactly where it bites.Verification
No stale references remain (
P@ssw0rd,SPRING_DATASOURCE_PASSWORD, the compose-editing instruction). Sphinx builds clean.Docs-only — no code or compose changes.
🤖 Generated with Claude Code
Summary by CodeRabbit
.envand to fail fast if any required values are missing.KEYCLOAK_ADMIN/KEYCLOAK_ADMIN_PASSWORDrequirements; added instructions to change the seeded demo login.POSTGRES_USER/POSTGRES_DBonly apply during first-time volume initialization.