feat: secure organization provider credentials

2026-07-10 22:04:43 +08:00
parent e049cb6880
commit 848f913597
51 changed files with 3280 additions and 230 deletions
@@ -7,6 +7,7 @@ Wants=network-online.target
 # this start-time assertion keeps later package/host changes fail-closed.
 AssertPathExists=__BWRAP_BIN__
 AssertPathExists=__SOCAT_BIN__
+AssertPathExists=__KEYRING_FILE__

 [Service]
 Type=simple
@@ -18,6 +19,9 @@ Environment=HOME=__SERVICE_HOME__
 Environment=XDG_STATE_HOME=__STATE_DIR__
 Environment=XDG_CACHE_HOME=__CACHE_DIR__
 Environment=PATH=__RUNTIME_PATH__
+# ADR-0024: the root-owned source remains unreadable by the service account;
+# systemd materializes a read-only per-unit credential at runtime.
+LoadCredential=cph-secret-keyring:__KEYRING_FILE__
 UMask=0027
 # Run prisma migrations before each start, then launch the Hub.
 ExecStartPre=__NODE_BIN__ __HUB_DIR__/node_modules/prisma/build/index.js migrate deploy --schema __HUB_DIR__/prisma/schema.prisma