[Perl] DAQ system for the FAPG.
feat auto-generate and persist application secret
Replace the hardcoded secrets config with automatic generation. On first startup, a SHA-256 secret is generated from high-entropy sources (time, PID, rand) and stored in .mojo-secrets (chmod 0600). Subsequent startups read the persisted secret. - Removed 'secrets' key from dashboard.yml - Added .mojo-secrets to .gitignore - Each fresh clone/deploy generates its own secret automatically
.gitignore
@@ -1,2 +1,3 @@
1
1
# .gitignore for fapg-daq
2
2
*.bak
3
Added:
.mojo-secrets
roles/dashboard/dashboard.yml
@@ -1,6 +1,4 @@
1
1
---
2
Removed:
secrets:
3
Removed:
- CHANGEME
4
2
weather:
5
3
enabled: 1
6
4
latitude: 46.303
roles/dashboard/lib/FAPG/DAQ/Dashboard.pm
@@ -12,8 +12,16 @@
12
12
# Load configuration from config file
13
13
my $config = $self->plugin('NotYAMLConfig');
14
14
15
Removed:
# Configure the application
16
Removed:
$self->secrets( $config->{secrets} );
15
Added:
# Auto-generate and persist a secret (never committed to VCS)
16
Added:
my $secret_file = $self->home->child('.mojo-secrets');
17
Added:
unless ( -f $secret_file ) {
18
Added:
require Digest::SHA;
19
Added:
my $secret = Digest::SHA::sha256_hex( join '', time, $$, rand, rand );
20
Added:
$secret_file->spew($secret);
21
Added:
chmod 0600, "$secret_file";
22
Added:
$self->log->info("Generated new application secret in $secret_file");
23
Added:
}
24
Added:
$self->secrets( [ $secret_file->slurp ] );
17
25
18
26
$self->config(
19
27
hypnotoad => {