bunker-admin
1bf19fff0e
Comprehensive 6-domain security audit addressing 8 Critical, 17 Important,
and 5 Low findings. Key fixes:
Critical:
- Strip PII from unauthenticated ticket lookup (IDOR)
- Add role+permission checks to event check-in routes
- Validate tier-to-event ownership on update/delete (IDOR)
- Fix path traversal in video replace (resolve + prefix check)
- Enable MongoDB authentication for Rocket.Chat
- Disable Grafana anonymous access
- Sanitize CSV exports against formula injection (payments)
- Apply DOMPurify to richDescription on public event page (XSS)
Important:
- Require current password for self-service password changes
- Atomic password reset token consumption (race condition fix)
- Scope postMessage to specific origin (not wildcard)
- Validate redirect parameter against open redirect
- Replace weak temp passwords (5760 values → crypto.randomBytes)
- Move shift capacity check inside transaction (TOCTOU fix)
- Fix EVENTS_ADMIN privilege inversion in ticketed events
- Make ENCRYPTION_KEY required (remove optional fallback)
- Add internal Prometheus metrics endpoint for Docker scraping
- Add nginx-level rate limiting (limit_req_zone)
- Fix X-Forwarded-For to use $remote_addr (prevents spoofing)
- Replace CSP stripping with frame-ancestors in embed proxies
- Remove error.message from Fastify 500 responses
- Strip PII from volunteer canvass address data
- Wrap GrapesJS output in {% raw %} to prevent Jinja2 SSTI
- Scope SSE token query param to /sse path only
- Sanitize Listmonk email query against injection
Bunker Admin
62 lines
1.4 KiB
YAML
62 lines
1.4 KiB
YAML
global:
|
|
scrape_interval: 15s
|
|
evaluation_interval: 15s
|
|
external_labels:
|
|
monitor: 'changemaker-lite'
|
|
|
|
# Alertmanager configuration
|
|
alerting:
|
|
alertmanagers:
|
|
- static_configs:
|
|
- targets: ['alertmanager:9093']
|
|
|
|
# Load rules once and periodically evaluate them
|
|
rule_files:
|
|
- "alerts.yml"
|
|
|
|
# Scrape configurations
|
|
scrape_configs:
|
|
# V2 Unified API Metrics
|
|
- job_name: 'changemaker-v2-api'
|
|
static_configs:
|
|
- targets: ['changemaker-v2-api:4000']
|
|
metrics_path: '/api/metrics/internal'
|
|
scrape_interval: 10s
|
|
scrape_timeout: 5s
|
|
|
|
# N8N Metrics (if available)
|
|
- job_name: 'n8n'
|
|
static_configs:
|
|
- targets: ['n8n-changemaker:5678']
|
|
metrics_path: '/metrics'
|
|
scrape_interval: 30s
|
|
|
|
# Redis Metrics
|
|
- job_name: 'redis'
|
|
static_configs:
|
|
- targets: ['redis-exporter:9121']
|
|
scrape_interval: 15s
|
|
|
|
# cAdvisor - Docker container metrics
|
|
- job_name: 'cadvisor'
|
|
static_configs:
|
|
- targets: ['cadvisor:8080']
|
|
scrape_interval: 15s
|
|
|
|
# Node Exporter - System metrics
|
|
- job_name: 'node'
|
|
static_configs:
|
|
- targets: ['node-exporter:9100']
|
|
scrape_interval: 15s
|
|
|
|
# Prometheus self-monitoring
|
|
- job_name: 'prometheus'
|
|
static_configs:
|
|
- targets: ['localhost:9090']
|
|
|
|
# Alertmanager monitoring
|
|
- job_name: 'alertmanager'
|
|
static_configs:
|
|
- targets: ['alertmanager:9093']
|
|
scrape_interval: 30s
|