Try and use better defaults when avaliable for local encryption - #124
Conversation
There was a problem hiding this comment.
Pull request overview
This pull request enhances the local encryption service configuration by providing better defaults when explicit values are not configured. The changes move shared constants to a centralized location, improve encryption defaults by falling back to system hostname and server secret, and enhance the health check UI to display more granular status information. Additionally, the PR updates the Temporal health check implementation to use a counting approach instead of the health check API for better compatibility with Temporal Cloud.
- Centralized constants to
internal/commonpackage for better code organization - Enhanced local encryption to use hostname as salt and server secret as password when not explicitly configured
- Improved UI health status display with Alpine.js for dynamic updates and granular status indicators
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| internal/common/constants.go | New file centralizing default constants (DefaultServerSecret, DefaultLoginServerEndpoint) |
| internal/config/config.go | Updated to reference constants from common package instead of local definitions |
| internal/config/model.go | Modified to pass server secret to services client for encryption fallback |
| internal/config/services/client.go | Added GetSecret() method to provide server secret for encryption configuration |
| internal/config/services/encryption.go | Enhanced to auto-populate salt with hostname and password with server secret when not configured |
| internal/config/services/encrypt/local.go | Added warning when default secrets are used for encryption |
| internal/daemon/setup.go | Updated to reference constants from common package |
| internal/daemon/middleware.go | Updated to reference constants from common package |
| internal/daemon/server.go | Changed Temporal health check from CheckHealth to CountWorkflowExecutions for cloud compatibility |
| internal/models/common.go | Added HasString() helper method to check for key presence in BasicConfig |
| internal/daemon/static/styles.css | Added CSS classes for health status indicators (healthy, degraded, unhealthy) |
| internal/daemon/static/index.html | Enhanced health check UI with Alpine.js for dynamic status updates |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 22858776 | Triggered | Generic Password | 53617a7 | internal/config/services/encrypt/local_test.go | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Try and fallback to a better secret than changeme if the user does not set it in the config