RC-6

cmd/server/main.go

@@ -3,6 +3,7 @@ package main
 import (
 	"bufio"
 	"context"
+	"fmt"
 	"log"
 	"net/http"
 	"os"
@@ -61,8 +62,26 @@ func loadDotEnv(path string) {
 	}
 }
 
+func validateSecurityConfig() error {
+	if strings.EqualFold(strings.TrimSpace(os.Getenv("ALLOW_INSECURE_DEV_DEFAULTS")), "1") {
+		return nil
+	}
+	jwt := strings.TrimSpace(os.Getenv("JWT_SECRET"))
+	if len(jwt) < 32 || jwt == "dev-secret-change-me" || jwt == "change-me-to-a-long-random-secret" {
+		return fmt.Errorf("JWT_SECRET must be set to a unique random value of at least 32 characters (or set ALLOW_INSECURE_DEV_DEFAULTS=1 for local development only)")
+	}
+	pass := strings.TrimSpace(os.Getenv("ADMIN_PASSWORD"))
+	if len(pass) < 16 || pass == "change-me" {
+		return fmt.Errorf("ADMIN_PASSWORD must be set to a unique value of at least 16 characters")
+	}
+	return nil
+}
+
 func main() {
 	loadDotEnv(".env")
+	if err := validateSecurityConfig(); err != nil {
+		log.Fatal(err)
+	}
 	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
 	defer cancel()
 
@@ -94,10 +113,17 @@ func main() {
 	srv := server.New(store, a, sm, hub, runtimeState, artifactDir, aw)
 	go srv.Scheduler(ctx)
 
-	httpSrv := &http.Server{Addr: env("HTTP_ADDR", ":8080"), Handler: srv.Routes(), ReadHeaderTimeout: 5 * time.Second}
+	publicSrv := &http.Server{Addr: env("HTTP_ADDR", ":8080"), Handler: srv.PublicRoutes(), ReadHeaderTimeout: 5 * time.Second, IdleTimeout: 60 * time.Second}
+	adminSrv := &http.Server{Addr: env("ADMIN_HTTP_ADDR", ":8081"), Handler: srv.AdminRoutes(), ReadHeaderTimeout: 5 * time.Second, IdleTimeout: 60 * time.Second}
 	go func() {
-		log.Printf("listening on %s", httpSrv.Addr)
-		if err := httpSrv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+		log.Printf("public listener on %s", publicSrv.Addr)
+		if err := publicSrv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			log.Fatal(err)
+		}
+	}()
+	go func() {
+		log.Printf("admin listener on %s (do not expose publicly)", adminSrv.Addr)
+		if err := adminSrv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
 			log.Fatal(err)
 		}
 	}()
@@ -105,5 +131,6 @@ func main() {
 	<-ctx.Done()
 	shutdown, done := context.WithTimeout(context.Background(), 10*time.Second)
 	defer done()
-	_ = httpSrv.Shutdown(shutdown)
+	_ = publicSrv.Shutdown(shutdown)
+	_ = adminSrv.Shutdown(shutdown)
 }