refactor(hobby): use dedicated browserless token instead of POSTHOG_SECRET

Fresh installs generate a separate BROWSERLESS_SECRET so the rendering
container (which loads untrusted web pages) never holds Django's
SECRET_KEY. The compose file falls back to POSTHOG_SECRET for existing
installs whose .env predates the variable.

Author: Piccirello

bin/deploy-hobby

@@ -134,9 +134,14 @@ if [ -f .env ]; then
 else
     POSTHOG_SECRET=$(head -c 28 /dev/urandom | sha224sum -b | head -c 56)
     ENCRYPTION_SALT_KEYS=$(openssl rand -hex 16)
+    # Dedicated browserless token so a compromise of the rendering container can't yield
+    # Django's SECRET_KEY (the compose file falls back to POSTHOG_SECRET when unset, for
+    # installs whose .env predates this variable).
+    BROWSERLESS_SECRET=$(openssl rand -hex 32)
     cat > .env <<EOF
 POSTHOG_SECRET=$POSTHOG_SECRET
 ENCRYPTION_SALT_KEYS=$ENCRYPTION_SALT_KEYS
+BROWSERLESS_SECRET=$BROWSERLESS_SECRET
 DOMAIN=$DOMAIN
 TLS_BLOCK=$TLS_BLOCK
 REGISTRY_URL=$REGISTRY_URL

docker-compose.hobby.yml

@@ -104,9 +104,9 @@ services:
             PERSONHOG_ENABLED: 'true'
             PERSONHOG_ROLLOUT_PERCENTAGE: '100'
             BROWSERLESS_CDP_URL: 'ws://browserless:3000'
-            BROWSERLESS_TOKEN: $POSTHOG_SECRET
+            BROWSERLESS_TOKEN: ${BROWSERLESS_SECRET:-$POSTHOG_SECRET}
             HEATMAP_BROWSERLESS_URL: 'http://browserless:3000'
-            HEATMAP_BROWSERLESS_TOKEN: $POSTHOG_SECRET
+            HEATMAP_BROWSERLESS_TOKEN: ${BROWSERLESS_SECRET:-$POSTHOG_SECRET}
             # blockConsentModals is a browserless.io cloud API extension; the OSS image 400s on it
             HEATMAP_BROWSERLESS_BLOCK_CONSENT_MODALS: 'false'
         image: $REGISTRY_URL:$POSTHOG_APP_TAG
@@ -344,7 +344,7 @@ services:
         restart: on-failure
         logging: *default-logging
         environment:
-            TOKEN: $POSTHOG_SECRET
+            TOKEN: ${BROWSERLESS_SECRET:-$POSTHOG_SECRET}
 
     asyncmigrationscheck:
         extends:
@@ -406,9 +406,9 @@ services:
             SITE_URL: https://$DOMAIN
             SECRET_KEY: $POSTHOG_SECRET
             BROWSERLESS_CDP_URL: 'ws://browserless:3000'
-            BROWSERLESS_TOKEN: $POSTHOG_SECRET
+            BROWSERLESS_TOKEN: ${BROWSERLESS_SECRET:-$POSTHOG_SECRET}
             HEATMAP_BROWSERLESS_URL: 'http://browserless:3000'
-            HEATMAP_BROWSERLESS_TOKEN: $POSTHOG_SECRET
+            HEATMAP_BROWSERLESS_TOKEN: ${BROWSERLESS_SECRET:-$POSTHOG_SECRET}
             # blockConsentModals is a browserless.io cloud API extension; the OSS image 400s on it
             HEATMAP_BROWSERLESS_BLOCK_CONSENT_MODALS: 'false'
         depends_on: