randomparity / randomparity/kdive
Keycloak host: move DB password out of cleartext keycloak.conf
Open
area:security
effort:S
priority:P3
risk:daytime-only
status:ready
type:chore
- Dominant language
- Python
- Stars
- 0
- Forks
- 0
- Avg merge
- 1h 26m
- Merged PRs (30d)
- 311
Description
On the Keycloak host (`keycloak.prod.pdx.drc.nz`), `/opt/keycloak/conf/keycloak.conf` carries `db-password` in cleartext. The DB is local-only (Postgres on `127.0.0.1`), so exposure is limited, but the secret should not live in a plain config file.
## Scope
- Move `db-password` to an environment variable / secret (`KC_DB_PASSWORD` via the systemd unit `EnvironmentFile=`, or a secrets store) and remove it from `keycloak.conf`.
- Confirm `keycloak.conf` file permissions are `0600` (currently owned `keycloak:keycloak`, mode `0600` — verify after edits).
Host operations only; no code change in this repo.
Contributor guide
Assessment
This issue has not been assessed yet.