starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-11-06 13:10:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): secure remote command secrets and clone volume data

Browse Source
This commit is contained in:
Andras Bacsai
2026-10-27 09:47:18 +01:00
parent 1d286427ad
commit 1a2a5362ad
203 changed files with 4315 additions and 1065 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Models/EnvironmentVariable.php
+19 -1
View File
@@ -55,6 +55,17 @@ class EnvironmentVariable extends BaseModel
'RAILPACK_SKIP_MIGRATIONS',
];
/**
* Magic variable commands (SERVICE_<COMMAND>_<NAME>) whose value generateEnvValue() generates.
*/
public const GENERATED_MAGIC_VARIABLE_COMMANDS = [
'PASSWORD', 'PASSWORD_64', 'PASSWORDWITHSYMBOLS', 'PASSWORDWITHSYMBOLS_64',
'BASE64', 'BASE64_32', 'BASE64_64', 'BASE64_128',
'REALBASE64', 'REALBASE64_32', 'REALBASE64_64', 'REALBASE64_128',
'HEX_32', 'HEX_64', 'HEX_128',
'USER', 'LOWERCASEUSER', 'SUPABASEANON', 'SUPABASESERVICE',
];
protected $attributes = [
'is_runtime' => true,
'is_buildtime' => true,
@@ -125,7 +136,8 @@ class EnvironmentVariable extends BaseModel
if (! $found) {
$application = Application::find($environment_variable->resourceable_id);
if ($application) {
// A compose preview generates its own magic secrets on the first pull request parse.
if ($application && ! ($application->build_pack === 'dockercompose' && $environment_variable->isGeneratedMagicVariable())) {
ModelsEnvironmentVariable::create([
'key' => $environment_variable->key,
'value' => $environment_variable->value,
@@ -156,6 +168,12 @@ class EnvironmentVariable extends BaseModel
});
}
public function isGeneratedMagicVariable(): bool
{
return str_starts_with($this->key, 'SERVICE_')
&& in_array(parseCommandFromMagicEnvVariable($this->key)->value(), self::GENERATED_MAGIC_VARIABLE_COMMANDS, true);
}
public function preservesLegacyComposeNull(): bool
{
return $this->preserve_compose_null && $this->value === null;