jenkins: envsubst allowlists, chmod 600 .env, tighten Django defaults

Three Copilot findings from the thirteenth pass on PR #330:

- harbor/deploy.sh: pass an explicit allowlist to every `envsubst`
  call. Without it, envsubst expands every `$VAR` sequence in the
  template, so any future secret containing a `$`-prefixed substring
  (HARBOR_ADMIN_PASSWORD, PULL_PASS) could be silently mangled. Now
  each call lists just the variables it actually templates.
- setup.sh: `chmod 600 .env` after persisting config. Once
  HARBOR_ADMIN_PASSWORD lands here it's secret material; a default
  umask of 022 would leave it group/world-readable.
- python312-pip-django/app.py: read SECRET_KEY from DJANGO_SECRET_KEY
  with a demo-only fallback, and narrow ALLOWED_HOSTS from `["*"]`
  to `["localhost", "127.0.0.1", "testserver"]`. The Test stage's
  Django Client uses Host: testserver, so the smoke test still
  passes (verified locally against an in-memory venv).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ericsmalling

jenkins/apps/python312-pip-django/app.py

@@ -13,9 +13,18 @@
 
 settings.configure(
     DEBUG=False,
-    SECRET_KEY="demo-not-secret",
+    # Demo-only fallback. In any non-demo deployment, set DJANGO_SECRET_KEY
+    # in the environment — Django's signed cookies, password reset tokens,
+    # and CSRF tokens all derive from this key, so a static value defeats
+    # those protections.
+    SECRET_KEY=os.environ.get("DJANGO_SECRET_KEY", "demo-not-secret"),
     ROOT_URLCONF=__name__,
-    ALLOWED_HOSTS=["*"],
+    # Localhost + the test client's default host ("testserver") only.
+    # ALLOWED_HOSTS=["*"] would let the container respond to any Host
+    # header — a Host-header injection risk if the image ever escaped its
+    # localhost demo context. The pipeline's smoke test uses Client().get(),
+    # which sends Host: testserver, so we include that explicitly.
+    ALLOWED_HOSTS=["localhost", "127.0.0.1", "testserver"],
     INSTALLED_APPS=["django.contrib.contenttypes", "django.contrib.auth"],
     MIDDLEWARE=[],
     # In-memory SQLite — contrib.contenttypes and contrib.auth declare models

jenkins/harbor/deploy.sh

@@ -48,8 +48,15 @@ else
 fi
 
 echo "==> Rendering manifests with REGISTRY_URL=${REGISTRY_URL}..."
-envsubst < cg/manifests/deploy-ingress-nginx.template > cg/manifests/deploy-ingress-nginx.yaml
-envsubst < cg/helm/values.template               > cg/helm/values.yaml
+# Pass an explicit allowlist to envsubst so it only substitutes the variables
+# we intend to template. Without one it expands every `$VAR` in the file,
+# including anything `$FOO`-shaped that happens to appear inside a secret
+# (e.g. a future HARBOR_ADMIN_PASSWORD containing `$`) — corrupting the
+# rendered output. The allowlist syntax is `'$NAME1 $NAME2 ...'`.
+envsubst '$REGISTRY_URL' \
+  < cg/manifests/deploy-ingress-nginx.template > cg/manifests/deploy-ingress-nginx.yaml
+envsubst '$REGISTRY_URL $HARBOR_ADMIN_PASSWORD' \
+  < cg/helm/values.template > cg/helm/values.yaml
 
 # Namespaces (idempotent).
 kubectl get ns ingress-nginx >/dev/null 2>&1 || kubectl create ns ingress-nginx
@@ -92,7 +99,11 @@ done
 
 echo "==> Configuring Harbor with Terraform (cgr.dev proxy registry + cgr-proxy project)..."
 export PULL_USER PULL_PASS
-envsubst < terraform/terraform.templatevars > terraform/terraform.tfvars
+# Same allowlist treatment as the manifests above — keeps `$`-containing
+# secrets (e.g. HARBOR_ADMIN_PASSWORD, PULL_PASS) from being interpreted as
+# `$VAR` references and silently corrupting the tfvars output.
+envsubst '$ORG_NAME $PULL_USER $PULL_PASS $HARBOR_ADMIN_PASSWORD' \
+  < terraform/terraform.templatevars > terraform/terraform.tfvars
 ( cd terraform
   terraform init -input=false -upgrade
   terraform apply -input=false -auto-approve

jenkins/setup.sh

@@ -358,6 +358,11 @@ if [[ "$HARBOR_ENABLED" == "true" ]]; then
   validate_env_value HARBOR_ADMIN_PASSWORD "$HARBOR_ADMIN_PASSWORD" || exit 1
   update_env HARBOR_ADMIN_PASSWORD "$HARBOR_ADMIN_PASSWORD"
 fi
+# Tighten .env perms unconditionally — once HARBOR_ADMIN_PASSWORD lands
+# here it's a secret, and any future variables we persist could be too.
+# 600 = host-user-only; both `bash source` and `docker compose --env-file`
+# only need the invoking user to read it.
+chmod 600 .env
 
 # ---- Phase 2: (re)create Jenkins with the new env so its OIDC signing key
 #               is the one we'll upload to Chainguard in Phase 3. ----