pdurlej/platform

Fork 0

fix(secrets): remove Honcho Redis password from container argv #124

New issue

Closed

opened 2026-05-09 00:58:21 +02:00 by codex · 3 comments

codex commented

2026-05-09 00:58:21 +02:00

Collaborator

Context

During Wave 2 v2 cataloging for issue #100, Codex attempted to verify Honcho Redis persistence mode without reading secret stores.

A read-only docker inspect of home-platform-honcho-redis-1 showed that the Redis password is embedded in the container command/argv. The value is intentionally not copied here.

Why this matters

Secrets in argv/container command are visible to Docker users and can leak through diagnostics, logs, support bundles, and agent transcripts. This violates the platform's secret-handling posture: no raw secrets in argv, logs, PR text, or agent-visible output.

Scope

Move Honcho Redis authentication away from command-line argv into a safer secret delivery path, then re-run issue #100 v2 cataloging.

Acceptance criteria

docker inspect home-platform-honcho-redis-1 --format '{{json .Config.Cmd}}' no longer contains a raw Redis password.
Redis still requires authentication.
Honcho services still connect successfully.
No secret value is committed, pasted, or printed in PR bodies/logs.
Issue #100 can verify persistence mode without exposing the credential.

Out of scope

Do not rotate or print the current secret in this issue thread.
Do not change Honcho data retention semantics without operator approval.

Trace

Blocks #100 until resolved or operator explicitly accepts the residual risk.

## Context During Wave 2 v2 cataloging for issue #100, Codex attempted to verify Honcho Redis persistence mode without reading secret stores. A read-only `docker inspect` of `home-platform-honcho-redis-1` showed that the Redis password is embedded in the container command/argv. The value is intentionally not copied here. ## Why this matters Secrets in argv/container command are visible to Docker users and can leak through diagnostics, logs, support bundles, and agent transcripts. This violates the platform's secret-handling posture: no raw secrets in argv, logs, PR text, or agent-visible output. ## Scope Move Honcho Redis authentication away from command-line argv into a safer secret delivery path, then re-run issue #100 v2 cataloging. ## Acceptance criteria - `docker inspect home-platform-honcho-redis-1 --format '{{json .Config.Cmd}}'` no longer contains a raw Redis password. - Redis still requires authentication. - Honcho services still connect successfully. - No secret value is committed, pasted, or printed in PR bodies/logs. - Issue #100 can verify persistence mode without exposing the credential. ## Out of scope - Do not rotate or print the current secret in this issue thread. - Do not change Honcho data retention semantics without operator approval. ## Trace - Blocks #100 until resolved or operator explicitly accepts the residual risk.

codex added the

class/security-sensitive

label

2026-05-09 00:58:21 +02:00

codex referenced this issue

2026-05-09 01:05:52 +02:00

feat(modules/honcho-redis): upgrade manifest to v2 cataloging #100

codex referenced this issue

2026-05-09 01:06:16 +02:00

[meta] Phase 02 v2 cataloging — first 5-10 priority modules to v2 #70

claude referenced this issue from a commit

2026-05-09 23:43:29 +02:00

docs(prompts): codex cleanup prompt — #122 (token-budget waivers) + #124 (honcho-redis secret) + #100 (cataloging)

claude referenced this issue

2026-05-09 23:44:14 +02:00

docs(prompts): codex cleanup prompt — #122 + #124 + #100 (combined) #136

pdurlej referenced this issue from a commit

2026-05-09 23:48:18 +02:00

Merge pull request 'docs(prompts): codex cleanup prompt — #122 + #124 + #100 (combined)' (#136) from claude/orders/codex-cleanup-122-124 into main

codex commented

2026-05-09 23:53:31 +02:00

Author

Collaborator

Role: executor
Intent: checkpoint
Needs owner: yes

Packet N is blocked before code changes.

What I verified:

pdurlej/platform does not contain the authoritative compose file; it only has the module manifest/runbook.
The authoritative compose file is in /opt/vps-home-platform-infra/compose/apps/compose.yaml on RS2000, under a separate git repo: pdurlej/vps-home-platform-infra.
The RS2000 infra worktree is dirty and main is ahead/behind origin, so directly editing it from this platform task would not be a clean reviewable PR.
The codex PAT used for platform PRs cannot clone pdurlej/vps-home-platform-infra (Repository not found), so I cannot open the proper infra PR as codex from here.
Honcho API and Honcho Deriver command argv do not contain Redis/password/requirepass terms; I found no bundled client argv leak in those two containers.
Honcho Redis still has --requirepass in container command argv. I did not paste the secret value.

I am stopping instead of mutating the live RS2000 compose checkout. A safe fix needs either:

grant codex access to pdurlej/vps-home-platform-infra and run this as an infra PR, or
operator/orchestrator prepares a clean infra branch/worktree for Codex, or
operator explicitly applies the compose hotfix manually and then #100 can be retried.

Recommended fix shape once infra PR access exists:

change honcho-redis command to use redis-server --appendonly yes --save 60 1 --requirepass "$$REDIS_PASSWORD"
add environment: ["REDIS_PASSWORD=${HONCHO_REDIS_PASSWORD:?set HONCHO_REDIS_PASSWORD}"]
redeploy only after merge: operator runs docker compose up -d honcho-redis

Next: choose infra PR access or manual operator hotfix; then re-run Packet N/#124.

**Role:** executor **Intent:** checkpoint **Needs owner:** yes Packet N is blocked before code changes. What I verified: - `pdurlej/platform` does not contain the authoritative compose file; it only has the module manifest/runbook. - The authoritative compose file is in `/opt/vps-home-platform-infra/compose/apps/compose.yaml` on RS2000, under a separate git repo: `pdurlej/vps-home-platform-infra`. - The RS2000 infra worktree is dirty and `main` is ahead/behind origin, so directly editing it from this platform task would not be a clean reviewable PR. - The codex PAT used for platform PRs cannot clone `pdurlej/vps-home-platform-infra` (`Repository not found`), so I cannot open the proper infra PR as codex from here. - Honcho API and Honcho Deriver command argv do not contain Redis/password/requirepass terms; I found no bundled client argv leak in those two containers. - Honcho Redis still has `--requirepass` in container command argv. I did not paste the secret value. I am stopping instead of mutating the live RS2000 compose checkout. A safe fix needs either: 1. grant codex access to `pdurlej/vps-home-platform-infra` and run this as an infra PR, or 2. operator/orchestrator prepares a clean infra branch/worktree for Codex, or 3. operator explicitly applies the compose hotfix manually and then #100 can be retried. Recommended fix shape once infra PR access exists: - change `honcho-redis` command to use `redis-server --appendonly yes --save 60 1 --requirepass "$$REDIS_PASSWORD"` - add `environment: ["REDIS_PASSWORD=${HONCHO_REDIS_PASSWORD:?set HONCHO_REDIS_PASSWORD}"]` - redeploy only after merge: operator runs `docker compose up -d honcho-redis` **Next:** choose infra PR access or manual operator hotfix; then re-run Packet N/#124.

claude referenced this issue

2026-05-09 23:54:00 +02:00

test(verify): cherry-pick L4-Verify suite to main (fix #123 base_ref oversight) #137

codex referenced this issue

2026-05-10 00:14:39 +02:00

test(verify): add l4 prompt waivers #139

codex added this to the 03 - Secrets and access hardening milestone

2026-05-19 08:36:21 +02:00

codex referenced this issue

2026-05-24 18:32:58 +02:00

docs(secrets): start W4 access hardening #435

codex referenced this issue

2026-05-24 19:27:18 +02:00

docs(secrets): choose Infisical primary pipeline #438

codex referenced this issue

2026-05-24 19:27:33 +02:00

fix(security): finish Bws/Infisical secrets injection — close 3-thread gap #237

codex referenced this issue

2026-05-24 19:48:55 +02:00

docs(secrets): record BWS recovery recon #440

codex referenced this issue

2026-05-24 19:49:13 +02:00

fix(security): finish Bws/Infisical secrets injection — close 3-thread gap #237

codex referenced this issue from a pull request that will close it,

2026-05-24 19:50:32 +02:00

docs(secrets): record Honcho Redis argv leak closure #441

codex commented

2026-05-24 19:50:47 +02:00

Author

Collaborator

W4c Fork C — argv leak evidence PR opened — 2026-05-24

Role: executor
Intent: checkpoint
Needs owner: via PR merge decision

Opened #441.

Finding

Current RS2000 runtime no longer has the Honcho Redis password value in Config.Cmd.

Metadata-only evidence:

cmd_contains_redis_password_value=false
cmd_has_literal_env_ref=true
unauth_ping_rejected=true
authenticated_ping_ok=true via REDISCLI_AUTH
Honcho Redis/API/Deriver containers are running and healthy

No secret value was printed or stored. No runtime mutation was performed.

Residual risk

The password still exists in the container environment. That is a separate redis-password-env-var-interim hardening class, not the raw argv leak tracked here.

Recommendation

Merge #441 and close this issue. #100 can continue cataloging without exposing the credential through Config.Cmd.

## W4c Fork C — argv leak evidence PR opened — 2026-05-24 **Role:** executor **Intent:** checkpoint **Needs owner:** via PR merge decision Opened #441. ### Finding Current RS2000 runtime no longer has the Honcho Redis password value in `Config.Cmd`. Metadata-only evidence: - `cmd_contains_redis_password_value=false` - `cmd_has_literal_env_ref=true` - `unauth_ping_rejected=true` - `authenticated_ping_ok=true` via `REDISCLI_AUTH` - Honcho Redis/API/Deriver containers are running and healthy No secret value was printed or stored. No runtime mutation was performed. ### Residual risk The password still exists in the container environment. That is a separate `redis-password-env-var-interim` hardening class, not the raw argv leak tracked here. ### Recommendation Merge #441 and close this issue. #100 can continue cataloging without exposing the credential through `Config.Cmd`.

codex referenced this issue

2026-05-24 19:56:49 +02:00

fix(security): finish Bws/Infisical secrets injection — close 3-thread gap #237

codex referenced this issue from a pull request that will close it,

2026-05-24 20:19:05 +02:00

docs(secrets): integrate W4 closeout forks #443

codex commented

2026-05-24 20:19:56 +02:00

Author

Collaborator

W4c Honcho Redis argv evidence has been consolidated into #443. If #443 merges, this issue should close: current runtime no longer exposes the raw Redis password value in Config.Cmd; residual container-env exposure should be tracked separately if desired.

pdurlej closed this issue

2026-05-24 20:24:53 +02:00

codex referenced this issue

2026-05-24 20:28:05 +02:00

docs(secrets): formally close W4 #444

codex referenced this issue

2026-05-29 16:49:43 +02:00

fix(security): finish Bws/Infisical secrets injection — close 3-thread gap #237