feat: secure organization provider credentials

hub/deploy/install_service.sh

@@ -21,6 +21,7 @@ WORKSPACE_ROOT="${WORKSPACE_ROOT:-/var/lib/cph-hub/workspaces}"
 HOST="${HOST:-127.0.0.1}"
 PORT="${PORT:-8788}"
 ENV_FILE="${ENV_FILE:-$BASE/.secrets/platform.env}"
+KEYRING_FILE="${KEYRING_FILE:-$BASE/.secrets/secret-keyring.json}"
 SYSTEMD_UNIT_DIR="${SYSTEMD_UNIT_DIR:-/etc/systemd/system}"
 NODE_BIN="${NODE_BIN:-$(command -v node || true)}"
 BWRAP_BIN="${BWRAP_BIN:-$(command -v bwrap || true)}"
@@ -63,7 +64,7 @@ if [ "$SERVICE_USER" = "root" ] || [ "$SERVICE_GROUP" = "root" ]; then
   fail "the Hub service identity must not be root"
 fi
 
-for command in getent groupadd useradd install stat systemctl id; do
+for command in getent groupadd useradd install stat systemctl id openssl date mktemp; do
   require_command "$command"
 done
 for pair in \
@@ -97,6 +98,7 @@ for pair in \
   "CACHE_DIR:$CACHE_DIR" \
   "WORKSPACE_ROOT:$WORKSPACE_ROOT" \
   "ENV_FILE:$ENV_FILE" \
+  "KEYRING_FILE:$KEYRING_FILE" \
   "SYSTEMD_UNIT_DIR:$SYSTEMD_UNIT_DIR" \
   "NODE_BIN:$NODE_BIN" \
   "BWRAP_BIN:$BWRAP_BIN" \
@@ -107,6 +109,32 @@ for pair in \
   require_safe_unit_value "${pair%%:*}" "${pair#*:}"
 done
 
+KEYRING_CREATED=false
+if [ -L "$KEYRING_FILE" ]; then
+  fail "local secret keyring must not be a symlink: $KEYRING_FILE"
+fi
+if [ ! -e "$KEYRING_FILE" ]; then
+  install -d -o root -g root -m 0700 "$(dirname "$KEYRING_FILE")"
+  key_id="local-$(date -u +%Y%m%dT%H%M%SZ)"
+  key_value="$(openssl rand -base64 32)"
+  tmp_keyring="$(mktemp "$(dirname "$KEYRING_FILE")/.secret-keyring.XXXXXX")"
+  trap 'rm -f "${tmp_keyring:-}"' EXIT
+  chmod 0600 "$tmp_keyring"
+  printf '{"version":1,"activeKeyId":"%s","keys":{"%s":"%s"}}\n' \
+    "$key_id" "$key_id" "$key_value" >"$tmp_keyring"
+  install -o root -g root -m 0600 "$tmp_keyring" "$KEYRING_FILE"
+  rm -f "$tmp_keyring"
+  tmp_keyring=""
+  trap - EXIT
+  unset key_value
+  KEYRING_CREATED=true
+  echo "[install] generated local secret keyring: $KEYRING_FILE" >&2
+fi
+[ -f "$KEYRING_FILE" ] || fail "local secret keyring is not a regular file: $KEYRING_FILE"
+keyring_metadata="$(stat -c '%u:%g:%a' -- "$KEYRING_FILE")"
+[ "$keyring_metadata" = "0:0:600" ] || \
+  fail "local secret keyring must be owned by root:root with mode 0600; found $keyring_metadata"
+
 if [ -L "$ENV_FILE" ]; then
   fail "environment file must not be a symlink: $ENV_FILE"
 fi
@@ -118,9 +146,6 @@ if [ ! -e "$ENV_FILE" ]; then
 # rerunning install_service.sh; failed preflight never installs the unit.
 NODE_ENV=production
 DATABASE_URL=
-ANTHROPIC_BASE_URL=https://openrouter.ai/api
-ANTHROPIC_AUTH_TOKEN=
-ANTHROPIC_API_KEY=
 FEISHU_APP_ID=
 FEISHU_APP_SECRET=
 FEISHU_BOT_OPEN_ID=
@@ -132,18 +157,24 @@ HUB_PUBLIC_BASE_URL=
 HUB_SESSION_SECRET=
 HUB_AGENT_MAX_TURNS=25
 HUB_FEISHU_LISTENER_ENABLED=true
-CPH_SANDBOX_EXTRA_DENY_READ=$ENV_FILE
+CPH_SANDBOX_EXTRA_DENY_READ=$ENV_FILE:$KEYRING_FILE
 EOF
   chmod 0600 "$ENV_FILE"
   echo "[install] seeded complete production configuration: $ENV_FILE" >&2
+  echo "[install] copy $KEYRING_FILE to the separately protected keyring backup before continuing" >&2
   echo "[install] fill every required blank, install cph at CPH_BIN, then rerun" >&2
   exit 78
 fi
 [ -f "$ENV_FILE" ] || fail "environment file is not a regular file: $ENV_FILE"
+if [ "$KEYRING_CREATED" = true ]; then
+  echo "[install] copy $KEYRING_FILE to the separately protected keyring backup, then rerun" >&2
+  exit 78
+fi
 
 PREFLIGHT_ARGS=(
   "$NODE_BIN" "$PREFLIGHT_JS"
   --env-file "$ENV_FILE"
+  --keyring-file "$KEYRING_FILE"
   --node-bin "$NODE_BIN"
   --runuser-bin "$RUNUSER_BIN"
   --setpriv-bin "$SETPRIV_BIN"
@@ -249,6 +280,7 @@ sed \
   -e "s|__WORKSPACE_ROOT__|$WORKSPACE_ROOT|g" \
   -e "s|__HUB_DIR__|$HUB_DIR|g" \
   -e "s|__ENV_FILE__|$ENV_FILE|g" \
+  -e "s|__KEYRING_FILE__|$KEYRING_FILE|g" \
   -e "s|__NODE_BIN__|$NODE_BIN|g" \
   -e "s|__BWRAP_BIN__|$BWRAP_BIN|g" \
   -e "s|__SOCAT_BIN__|$SOCAT_BIN|g" \