Keep the push URL out of the compose file, since it is a credential #21

2026-08-29T14:05:21-07:00

dejima-agent commented

2026-08-29 14:05:21 -07:00

Summary generated by LLM agent

Raised by the operator, and it is a rule this project had already written down without following it.

An Uptime Kuma push URL carries its token in the path. That is why heartbeat_url goes to curl through a config on stdin rather than in argv: the URL is the credential, not merely the destination. The compose example then set it in an environment: block, where docker inspect prints it and anything that can read /proc can see it. Exactly the exposure the ntfy token was already being kept out of, two settings apart in the same file.

Worth stating what it grants rather than leaving it as "a URL": anyone holding it can tell Kuma this guard is healthy, which suppresses the one signal that reports a guard that has died. That is the channel a compromised devbox cannot reach, and the reason this design has a second server at all.

It moves to the mounted config beside ntfy_token. The compose file says why it is absent, so the next person to look for it finds the reason rather than the gap. A test asserts that neither credential appears in the compose environment and that the setting is still documented where it went.

ntfy_url is left where it is: on an authenticated ntfy it is not a credential, and on a public one the page already says an unguessable topic name is not access control. Worth a separate decision rather than being swept along with this one.

Tested: 102 passing.

**Summary generated by LLM agent** Raised by the operator, and it is a rule this project had already written down without following it. An Uptime Kuma push URL carries its token in the path. That is why `heartbeat_url` goes to curl through a config on stdin rather than in argv: the URL is the credential, not merely the destination. The compose example then set it in an `environment:` block, where `docker inspect` prints it and anything that can read `/proc` can see it. Exactly the exposure the ntfy token was already being kept out of, two settings apart in the same file. Worth stating what it grants rather than leaving it as "a URL": anyone holding it can tell Kuma this guard is healthy, which suppresses the one signal that reports a guard that has died. That is the channel a compromised devbox cannot reach, and the reason this design has a second server at all. It moves to the mounted config beside `ntfy_token`. The compose file says why it is absent, so the next person to look for it finds the reason rather than the gap. A test asserts that neither credential appears in the compose environment and that the setting is still documented where it went. `ntfy_url` is left where it is: on an authenticated ntfy it is not a credential, and on a public one the page already says an unguessable topic name is not access control. Worth a separate decision rather than being swept along with this one. Tested: 102 passing.

dejima-agent added 1 commit 2026-08-29 14:05:22 -07:00

Keep the push URL out of the compose file, since it is a credential 74761e0376

An Uptime Kuma push URL carries its token in the path, which this project
already says: it is why the URL is passed to curl through a config on stdin
rather than in argv. The compose example then put it in an environment block,
where `docker inspect` prints it and anything that can read /proc can see it -
the same exposure the token was already being kept out of.

What it grants is worth stating rather than leaving as "a URL": anyone holding
it can tell Kuma this guard is healthy, which suppresses the one signal that
reports a guard that has died. That is the channel a compromised devbox cannot
reach, and the whole reason there is a second server in this design.

It goes in the mounted config beside ntfy_token now, with a test that neither
appears in the compose environment and that the setting is still documented
where it moved to.

branderson approved these changes 2026-08-29 14:06:51 -07:00

branderson merged commit 551e814f81 into main

2026-08-29 14:06:56 -07:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dejima/dejima-guard#21