From 11ded5f9dff24c0dc3d1722193a263b147a74d97 Mon Sep 17 00:00:00 2001 From: Jay Ravani Date: Fri, 24 Jul 2026 03:54:00 +0200 Subject: [PATCH] fix: read Caddy's X-Api-Key from IGNIS_API_KEY instead of hardcoding it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The key was hardcoded directly in the committed Caddyfile. Nothing in CI or elsewhere actually depends on that literal value (checked — no references outside the Caddyfile itself), so there was no reason it couldn't be an env var like ALLOWED_ORIGINS already is. Default value in docker.env is unchanged (supersecret123), so local dev behaves identically; a real deployment now only needs to override docker.env, not edit source. Verified live: rebuilt and ran the full ignis-db/ignis-app/ignis-reverse-proxy stack, confirmed 403 with no/wrong key and 200 with the configured key. --- environment/Caddyfile | 5 ++++- environment/docker.env | 5 +++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/environment/Caddyfile b/environment/Caddyfile index e9b21bd..16a43d7 100644 --- a/environment/Caddyfile +++ b/environment/Caddyfile @@ -19,7 +19,10 @@ localhost { respond 204 } - @authorized header X-Api-Key "supersecret123" + # Read from IGNIS_API_KEY at container start (see docker.env) rather than + # hardcoded here — a real key belongs in an untracked env file, not + # committed source. + @authorized header X-Api-Key {$IGNIS_API_KEY} handle @authorized { reverse_proxy ignis-app:{$APP_PORT:8080} } diff --git a/environment/docker.env b/environment/docker.env index 2c60f99..a57f1a3 100644 --- a/environment/docker.env +++ b/environment/docker.env @@ -25,3 +25,8 @@ POSTGRES_DB=ignis # matcher (see docker-compose.yml + Caddyfile). Add an origin here once — # nothing to update in the Caddyfile itself. ALLOWED_ORIGINS=http://localhost:5173,http://localhost:3000,http://localhost:8000,http://127.0.0.1:8000,https://thd-spatial-ai.github.io + +# Read by ignis-reverse-proxy's Caddyfile to gate the app behind the +# X-Api-Key header. Callers must send this same value. Rotate before any +# real deployment — this is a local-dev placeholder, not a secret. +IGNIS_API_KEY=supersecret123