Repository navigation
feat(docker)!: generated InfluxDB credentials, unprivileged web image, and retention margin - #972
Merged
Merged
Conversation
web.influxdb.token and web.influxdb.init_password no longer default to the public values scrutiny-default-admin-token and password12345. On first InfluxDB setup Scrutiny generates both, onboards with them, and saves them under web.secrets.dir (.influxdb-token, .influxdb-password, mode 0600). A configured token or password is used as given. An InfluxDB that is already onboarded keeps working: Scrutiny uses the configured token, then the saved token, then falls back to the legacy default token that earlier releases used, and logs a warning that recommends rotation. Secret values are never logged. The setup check now runs before the client is built so the generated token is the one the client uses.
…es nothing The weekly task reads data 7 to 14 days old but the metrics bucket kept only 15 days, so one missed Sunday run lost a week of history. Default daily retention is now 21 days and weekly retention 13 weeks, which gives the weekly and monthly tasks a week or more of margin. EnsureBuckets already applies configured retention to existing buckets on start, so installs on the defaults pick this up automatically.
The web entrypoint starts as root only to chown /opt/scrutiny/config and /opt/scrutiny/reports to PUID:PGID (default 1000:1000), then drops privileges with setpriv. Config volumes created as root by earlier releases are handed over automatically. PUID=0 keeps root; a container already started as non-root or without CAP_SETUID runs unchanged. Collector and omnibus images stay root because they need raw device access. BREAKING CHANGE: the web image now runs the server as uid 1000 (PUID/PGID) and changes the owner of files in the config volume. Set PUID=0 to keep running as root; volumes that refuse chown must be made writable by PUID:PGID.
The check passes while cron runs. Successful collections touch /tmp/scrutiny-collector-last-run; COLLECTOR_HEALTHCHECK_MAX_AGE_HOURS optionally fails the check when that file is too old.
… token in examples Example compose files, the README commands, and the Unraid templates no longer publish port 8086. The hub/spoke example and the Unraid web and collector templates now carry the auth token that the web server requires; the omnibus token stays optional because the container generates one. BREAKING CHANGE: example deployments no longer expose InfluxDB on port 8086. Existing deployments keep their current port mappings.
… feat/965-images-influx-retention
Starosdev
added
security
… feat/965-images-influx-retention
In the omnibus container a token set through SCRUTINY_WEB_AUTH_TOKEN stops the server writing .auth-token, so the bundled collectors got 401 or read a stale file. Precedence is now collector config, COLLECTOR_API_TOKEN, SCRUTINY_WEB_AUTH_TOKEN, then the generated file.
Use chown -h so symlinks are not followed, and drop with no_new_privs, no inheritable capabilities, and an empty bounding set (all flags exist in util-linux setpriv).
…xDB in README The collector templates marked the token required while saying it can be blank when auth is off; the flag is now optional. The README hub/spoke command puts InfluxDB on a Docker network instead of publishing 8086.
…nt cap_drop behavior On a 401 from an onboarded InfluxDB the log names whether the token came from config, the saved file, or the legacy default, never the value. UPGRADE and DEPLOYMENTS now state that cap_drop ALL needs user: PUID:PGID or CHOWN, SETUID, SETGID.
… feat/965-images-influx-retention
3 of 14 tasks
…x-retention # Conflicts: # collector/pkg/config/config_test.go
32 of 40 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
WP-C (images, InfluxDB bootstrap, retention) for the 2.0.0 release. InfluxDB admin credentials are generated at first setup instead of using published defaults, the web image runs as an unprivileged user, default retention leaves margin for a missed downsample run, the collector image gains a healthcheck, and the example deployments match the 2.0 auth default.
Stacked on #971 (security defaults): this branch contains #971's commits until that PR merges. Review only the commits not on
feat/965-security-defaults. It targetsbetaso the Docker build and permission checks run.Type of Change
Related Issues
Related to #965. Depends on #971.
Changes Made
web.influxdb.tokenandinit_passworddefault to empty. On a fresh Influx, Scrutiny generates both withsecrets.EnsureSecret, stores.influxdb-tokenand.influxdb-password(0600) inweb.secrets.dir, and onboards with them. Values are never logged. An explicitly configured token or password is used as given. For an already onboarded Influx the order is: configured token, saved.influxdb-token, then the legacyscrutiny-default-admin-tokenwith a rotation warning, so existing installs keep working. A fresh setup with an unwritable config dir fails at startup namingweb.influxdb.token.retention.daily15 to 21 days andretention.weekly9 to 13 weeks, so one missed weekly or monthly downsample run loses no history.EnsureBucketsapplies the new retention to existing buckets at start whenretention_policyis true; custom values are kept.entrypoint-web.shstarts as root, changes ownership of/opt/scrutiny/configand/opt/scrutiny/reportstoPUID:PGID(default 1000:1000), then drops privileges withsetpriv. Root-owned volumes from 1.x are handed over automatically;PUID=0keeps root. Collector and omnibus images stay root (raw device access; omnibus runs Influx, web, cron, and collectors under one supervisor).HEALTHCHECK(cron running, optionalCOLLECTOR_HEALTHCHECK_MAX_AGE_HOURS) and a run-state file touched after each successful run. Plaincollectorimage only.SCRUTINY_AUTH_TOKEN, mapped toSCRUTINY_WEB_AUTH_TOKENandCOLLECTOR_API_TOKEN. Unraid templates gain token fields and the omnibus template drops port 8086.docs/UPGRADE_2.0.mdsections for InfluxDB credentials, retention, and the web image user;DOWNSAMPLING.md,DEPLOYMENTS.md,TROUBLESHOOTING_INFLUXDB.md, README,example.scrutiny.yaml,TESTING.md.Testing
go build ./...,go vet ./...,go test ./...pass;golangci-lint run --new-from-rev(v2.14.0, linux/amd64) 0 issues;shellcheckclean on new scripts; compose YAML and Unraid XML parse;docker/tests/image-matrix_test.shpasses. Influx credential tests use a fake Influx server: fresh setup, configured token, onboarded instance, legacy fallback warning, unwritable dir. A retention margin test pins the defaults.Not verified locally (no Docker available): image builds,
setprivandfindin the base image,COPY --chmod, the HEALTHCHECK, the root-owned volume handover (docker/tests/frontend-permissions_test.shwas extended but not run), and a real Influx onboarding. This PR's Docker CI checks are the first real run.Checklist
Notes
Review: required (changes container privileges and credential bootstrap)