37 lines
1.6 KiB
Markdown
37 lines
1.6 KiB
Markdown
# 20260706 Auth GitOps Portal Hardening
|
|
|
|
Version: V1R1C4
|
|
Previous: V1R1C3
|
|
Timestamp: 2026-07-06T11:05:30Z
|
|
|
|
## User-visible fixes
|
|
|
|
- Human shortlinks no longer expose baseline/model/run JSON without portal login.
|
|
- The cnnetmkt portal has a visible GitOps section for owner/admin users.
|
|
- Gitea is served from `https://g.cnnetmkt.top/git/` and repository browsing requires login.
|
|
- Gitea `owner` password is synchronized from the cnnetmkt owner account secret.
|
|
- The default local Gitea account password is removed and direct login is disabled.
|
|
|
|
## Files
|
|
|
|
- `deploy/nginx/aios-gitops-locations.conf`
|
|
- `deploy/gitea-binary/app.ini.template`
|
|
- `deploy/systemd/aios-gitea-owner-sync.service`
|
|
- `deploy/systemd/aios-gitea-owner-sync.timer`
|
|
- `ops/gitops-migration/sync_gitea_owner_password.sh`
|
|
- `ops/gitops-migration/apply_user_portal_gitops_overlay.sh`
|
|
- `overlays/user-control-center/control/portal_views.py`
|
|
- `overlays/user-control-center/templates/portal/me.html`
|
|
- `baseline/current.json`
|
|
- `config/codex/gitops-online.json`
|
|
- `versions/V1R1C4.json`
|
|
- `docs/release/AIOS_V1R1C4_AUTH_GITOPS_PORTAL.md`
|
|
|
|
## Notes
|
|
|
|
Docker image rebuild was not required for the live fix. The runtime source and running container were patched, and the exact overlay has been added to GitOps so a later image rebuild can reproduce the change.
|
|
|
|
## Secret Log Hygiene
|
|
|
|
The Gitea owner password sync script uses `runuser` instead of `sudo -u ... --password ...`, strips CRLF from sourced owner fields, and does not print passwords or tokens. Archived journal files were rotated/vacuumed after the live script was corrected.
|