fix(security): require ADMIN_PASSWORD instead of logging a generated one

CodeQL go/clear-text-logging (high) flagged logging the generated admin
password. Logging a secret is a real leak (logs get shipped and read), so
remove it: when authentication is enabled the server now requires
ADMIN_PASSWORD and fails closed if it is unset, rather than seeding a
well-known password or logging a generated one. When authentication is
disabled (development) a random, unlogged password is seeded since it gates
nothing. Compose now requires ADMIN_PASSWORD via ${ADMIN_PASSWORD:?}; docs and
the k8s secret template are updated to match.

Author: slchris

.env.example

@@ -17,8 +17,9 @@ AUTH_ENABLED=true
 #   openssl rand -base64 32
 AUTH_SECRETKEY=
 
-# Initial admin password. Leave blank to have the server generate a random one
-# and print it once at first boot. Set it to choose your own.
+# Initial admin password. Required on first boot when AUTH_ENABLED=true: the
+# server refuses to create the admin account without it (it will not seed a
+# well-known password or log a generated one).
 #   openssl rand -base64 24
 ADMIN_PASSWORD=
 

README.md

@@ -27,17 +27,18 @@ git clone https://github.com/Veritas-Calculus/vc-terraform-registry.git
 cd vc-terraform-registry
 
 cp .env.example .env
-# Edit .env and set a strong AUTH_SECRETKEY: openssl rand -base64 32
-# The server refuses to start in release mode without one.
+# Edit .env and set two required secrets before first boot:
+#   AUTH_SECRETKEY  (openssl rand -base64 32) - JWT signing key
+#   ADMIN_PASSWORD  (openssl rand -base64 24) - initial admin password
+# The server refuses to start in release mode without a strong signing key,
+# and refuses to create the admin account without ADMIN_PASSWORD.
 
 docker compose up -d
 ```
 
 Then open `https://localhost:3443` (self-signed certificate; accept the warning).
-The Terraform CLI requires HTTPS, so use the 3443 port.
-
-On first boot, if you did not set `ADMIN_PASSWORD`, the backend generates a random
-admin password and prints it once in the logs (`docker compose logs backend`).
+The Terraform CLI requires HTTPS, so use the 3443 port. Sign in as `admin` with
+the `ADMIN_PASSWORD` you set.
 
 Ports: frontend HTTPS `3443`, frontend HTTP `3000`, backend API `127.0.0.1:8080`.
 

README.zh-CN.md

@@ -26,17 +26,17 @@ git clone https://github.com/Veritas-Calculus/vc-terraform-registry.git
 cd vc-terraform-registry
 
 cp .env.example .env
-# 编辑 .env，设置强随机 AUTH_SECRETKEY：openssl rand -base64 32
-# release 模式下缺少该密钥服务将拒绝启动。
+# 首次启动前在 .env 中设置两个必填密钥：
+#   AUTH_SECRETKEY  (openssl rand -base64 32) - JWT 签名密钥
+#   ADMIN_PASSWORD  (openssl rand -base64 24) - 初始管理员密码
+# release 模式下缺少强签名密钥服务将拒绝启动；未设置 ADMIN_PASSWORD 时拒绝创建管理员账号。
 
 docker compose up -d
 ```
 
 随后访问 `https://localhost:3443`（自签名证书，需要在浏览器中接受安全警告）。
-Terraform CLI 要求使用 HTTPS，请使用 3443 端口。
-
-首次启动时，若未设置 `ADMIN_PASSWORD`，后端会生成随机管理员密码并在日志中打印一次
-（`docker compose logs backend`）。
+Terraform CLI 要求使用 HTTPS，请使用 3443 端口。使用用户名 `admin` 和你设置的
+`ADMIN_PASSWORD` 登录。
 
 端口：前端 HTTPS `3443`、前端 HTTP `3000`、后端 API `127.0.0.1:8080`。
 

backend/cmd/server/main.go

@@ -141,39 +141,36 @@ func initDatabase(cfg *config.Config) (*gorm.DB, error) {
 	db.Model(&models.User{}).Count(&userCount)
 	if userCount == 0 {
 		adminPassword := os.Getenv("ADMIN_PASSWORD")
-		generated := false
 		if adminPassword == "" {
-			// Never fall back to a well-known password. Generate a strong random
-			// one and surface it once in the logs so the operator can capture it.
+			if cfg.Auth.Enabled {
+				// Fail closed rather than seed a well-known password or log a
+				// generated one (logging a secret is itself a leak). The operator
+				// must choose the initial admin password explicitly.
+				return nil, fmt.Errorf(
+					"ADMIN_PASSWORD is not set; set it to create the initial admin account " +
+						"(e.g. `openssl rand -base64 24`)")
+			}
+			// Authentication is disabled (development): the admin credential gates
+			// nothing, so seed a random password that is never logged.
 			adminPassword, err = generatePassword(24)
 			if err != nil {
 				return nil, fmt.Errorf("failed to generate admin password: %w", err)
 			}
-			generated = true
 		}
 		hashedPassword, err := auth.HashPassword(adminPassword)
 		if err != nil {
-			log.Printf("Warning: failed to hash admin password: %v", err)
-		} else {
-			adminUser := models.User{
-				Username: "admin",
-				Email:    "admin@localhost",
-				Password: hashedPassword,
-				Role:     "admin",
-			}
-			if err := db.Create(&adminUser).Error; err != nil {
-				log.Printf("Warning: failed to create admin user: %v", err)
-			} else if generated {
-				log.Printf("=====================================================================")
-				log.Printf("  Initial admin account created. Username: admin")
-				log.Printf("  Generated password: %s", adminPassword)
-				log.Printf("  Store it now and change it after first login. It is shown only once.")
-				log.Printf("  Set ADMIN_PASSWORD to choose your own on first boot.")
-				log.Printf("=====================================================================")
-			} else {
-				log.Printf("Initial admin user created (username: admin) from ADMIN_PASSWORD")
-			}
+			return nil, fmt.Errorf("failed to hash admin password: %w", err)
+		}
+		adminUser := models.User{
+			Username: "admin",
+			Email:    "admin@localhost",
+			Password: hashedPassword,
+			Role:     "admin",
+		}
+		if err := db.Create(&adminUser).Error; err != nil {
+			return nil, fmt.Errorf("failed to create admin user: %w", err)
 		}
+		log.Printf("Initial admin user 'admin' created")
 	}
 
 	log.Printf("Database initialized: %s", dbPath)

docker-compose.yml

@@ -18,9 +18,9 @@ services:
       - AUTH_ENABLED=true
       # Supplied from .env; compose aborts if unset. Generate: openssl rand -base64 32
       - AUTH_SECRETKEY=${AUTH_SECRETKEY:?set AUTH_SECRETKEY in .env (openssl rand -base64 32)}
-      # Initial admin password. If omitted, the backend generates a random one
-      # and prints it once at first boot; set it here to choose your own.
-      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+      # Initial admin password, required on first boot because auth is enabled.
+      # Generate: openssl rand -base64 24
+      - ADMIN_PASSWORD=${ADMIN_PASSWORD:?set ADMIN_PASSWORD in .env (openssl rand -base64 24)}
       - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-*}
       - LOG_LEVEL=info
     volumes:

docs/configuration.md

@@ -15,7 +15,7 @@ Environment variables take precedence.
 | `DATABASE_URL` | Database connection string | `sqlite:///data/registry.db` |
 | `AUTH_ENABLED` | Enable authentication | `true` |
 | `AUTH_SECRETKEY` | JWT signing key. Required in release mode; must be a strong random value of at least 32 bytes | none |
-| `ADMIN_PASSWORD` | Initial admin password. If unset, a random one is generated and printed once at first boot | none |
+| `ADMIN_PASSWORD` | Initial admin password. Required on first boot when `AUTH_ENABLED=true`; the server will not seed a well-known password or log a generated one | none |
 | `CORS_ALLOWED_ORIGINS` | Comma-separated allowed browser origins, or `*` for any | `*` |
 | `LOG_LEVEL` | Log level | `info` |
 

docs/deployment.md

@@ -6,7 +6,8 @@ Ensure Docker is running, then:
 
 ```bash
 cp .env.example .env
-# Set a strong AUTH_SECRETKEY (openssl rand -base64 32). Optionally set ADMIN_PASSWORD.
+# Set a strong AUTH_SECRETKEY (openssl rand -base64 32) and an ADMIN_PASSWORD
+# (openssl rand -base64 24). Both are required on first boot.
 
 # Using make
 make start

docs/security.md

@@ -38,7 +38,7 @@ a remediation note.
 | Sev | Finding | Fix |
 |-----|---------|-----|
 | Critical | JWT signing key was effectively unconfigurable and defaulted to a public placeholder; `docker-compose.yml` also hardcoded a public key as a literal, and the documented `.env` override was silently ignored. Anyone could forge an admin token offline. | Root cause was a Viper misconfiguration: nested keys (`auth.secretkey`) were never bound to env vars (`AUTH_SECRETKEY`), so every environment override was dropped. Added `SetEnvKeyReplacer` plus explicit `BindEnv` for all keys. Added a fail-closed guard that refuses to start in release mode on any known placeholder key or a key shorter than 32 bytes. `docker-compose.yml` now uses `${AUTH_SECRETKEY:?}` so Compose aborts when it is unset. `k8s/secret.yaml` ships with no value and documents out-of-band creation. `.env.example` blanks the key. Regression tests cover the env-override path and the guard. |
-| High | Default admin account `admin/admin123` was auto-created on first boot; no deployment path set `ADMIN_PASSWORD`. | If `ADMIN_PASSWORD` is unset, the server now generates a strong random password with `crypto/rand` and logs it once at first boot. The well-known fallback is gone. |
+| High | Default admin account `admin/admin123` was auto-created on first boot; no deployment path set `ADMIN_PASSWORD`. | When authentication is enabled, the server now requires `ADMIN_PASSWORD` and fails closed if it is unset - it never seeds a well-known password and never logs a generated one (logging a secret is itself a leak, flagged by CodeQL `go/clear-text-logging`). When authentication is disabled (development), a random unlogged password is seeded since it gates nothing. |
 | High | A committed key in `k8s/secret.yaml` was applied by the documented deploy command. | Value removed; the manifest documents `kubectl create secret` from a generated value. |
 | High | Unauthenticated mirror-protocol routes spawned one unbounded background upstream download per request (disk/bandwidth amplification DoS). | Background caching is now bounded by a semaphore (max 3 concurrent) and deduped by an in-flight set, launched via `tryStartBackgroundCache`. A burst degrades to "cached on a later request" instead of spawning unbounded goroutines. The routes stay unauthenticated so the Terraform network mirror keeps working. |
 | Medium | The role claim was never enforced: `RequireRole` was applied to zero routes, so any authenticated principal was fully privileged. | Write/management routes are now behind an admin group (`AuthMiddleware` + `RequireRole("admin")`). `/auth/me` stays at authenticated-only. Verified: a valid non-admin token gets 403 on writes. |

k8s/secret.yaml

@@ -21,7 +21,7 @@ stringData:
   # If you must template it, inject the values from your secret manager at apply
   # time; never store them in git.
   AUTH_SECRETKEY: ""  # REQUIRED: set to a strong random value out of band
-  ADMIN_PASSWORD: ""  # OPTIONAL: initial admin password; omit to auto-generate
+  ADMIN_PASSWORD: ""  # REQUIRED on first boot with auth enabled: initial admin password
 ---
 # TLS Secret for HTTPS (optional, create from your certificates)
 # kubectl create secret tls terraform-registry-tls \