Fases 7-8: snapshots btrfs, firma HMAC y métricas - #18
Conversation
- Fase 7: snapshots btrfs automáticos con snapper + snap-pac. - Nuevo módulo scripts/35-snapper.sh. - Configuraciones por perfil: snapshots.enabled y límites de retención. - Habilita timers snapper-timeline y snapper-cleanup. - Fase 8: firma HMAC-SHA256 de configuraciones y métricas. - El portal firma configs cuando NEUBAT_HMAC_SECRET está definido. - El instalador verifica la firma al descargar la config. - El instalador mide duración y la envía a /api/complete. - Nuevo endpoint /api/metrics con estadísticas agregadas. - Añade tests: 35 Jest, 10 bats. - Documentación actualizada en docs/INSTALL.md y .env.example.
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (15)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 4 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 1e5bee6. Configure here.
| 1) error "Firma HMAC de la configuración inválida. Posible manipulación en tránsito." ;; | ||
| 2) warning "Configuración sin firma HMAC; se omite la verificación" ;; | ||
| esac | ||
| fi |
There was a problem hiding this comment.
HMAC check never aborts install
High Severity
verify_config_signature inspects $? inside if ! python3, where that status is 0 rather than Python’s 1 or 2. Invalid or missing HMAC signatures therefore skip both error and warning, so a tampered config is accepted and the install continues.
Reviewed by Cursor Bugbot for commit 1e5bee6. Configure here.
| arch-chroot /mnt snapper -c root create-config / \ | ||
| || warning "No se pudo crear configuración snapper para /" | ||
| arch-chroot /mnt snapper -c home create-config /home \ | ||
| || warning "No se pudo crear configuración snapper para /home" |
There was a problem hiding this comment.
Snapper fails inside chroot
High Severity
snapper create-config runs under arch-chroot without --no-dbus. A chroot has no snapperd or D-Bus, so config creation fails and is only warned. Production has snapshots.enabled true, so timeline and snap-pac setup are skipped while the install still reports success.
Reviewed by Cursor Bugbot for commit 1e5bee6. Configure here.
|
|
||
| # Secreto compartido para firmar/verificar configuraciones con HMAC-SHA256. | ||
| # Debe coincidir con el valor usado por el instalador (NEUBAT_HMAC_SECRET). | ||
| NEUBAT_HMAC_SECRET=cambia-este-secreto-por-una-cadena-larga-y-aleatoria |
There was a problem hiding this comment.
HMAC secret unused in Docker
Medium Severity
NEUBAT_HMAC_SECRET is documented for Docker Compose via .env, but docker-compose.yml never injects it into the portal container (unlike ADMIN_TOKEN). The portal therefore never signs configs in the recommended deploy path, even when the secret is set.
Reviewed by Cursor Bugbot for commit 1e5bee6. Configure here.
| ...(Array.isArray(config.packages) ? config.packages.sort() : []), | ||
| ...(Array.isArray(config.services) ? config.services.sort() : []) | ||
| ]; | ||
| return parts.join('|'); |
There was a problem hiding this comment.
HMAC omits critical config fields
Medium Severity
The HMAC payload skips encryption and snapshots, and signConfig runs before those request overrides are merged. A transit attacker can disable LUKS or change snapshot policy without invalidating signature, which contradicts the claim that the downloaded config is integrity-protected.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 1e5bee6. Configure here.
1 participant
Implementa las fases 7 y 8 del roadmap de NEUBAT.
Fase 7 - Snapshots btrfs automáticos
Fase 8 - Firma HMAC y métricas
Validación
Note
Medium Risk
Changes touch install-time security (shared HMAC secret and config verification) and post-install system behavior (snapper timers);
/api/metricsexposes aggregate install data without new auth in this diff.Overview
Adds Phase 7 (automatic btrfs snapshots) and Phase 8 (HMAC-signed configs + install metrics) across profiles, the portal API, and the installer.
Snapshots: Profiles and
POST /api/installnow support asnapshotsblock (enabled flag and cleanup limits). When enabled, the installer runs newconfigure_snapperlogic: installssnapper/snap-pac, creates configs for/and/home, applies retention from the profile, and enables timeline/cleanup timers (failures warn but do not abort).HMAC:
NEUBAT_HMAC_SECRETsigns generated install JSON with HMAC-SHA256 (signaturefield). The live installer verifies the same payload after fetch and aborts on mismatch; missing secret or unsigned local profiles skip verification with a warning.Metrics: The installer records elapsed time and sends
durationon/api/complete. NewGET /api/metricsreturns aggregated counts and average duration. Docs and tests cover env vars, API, snapper usage, signing, and nested config reads.Reviewed by Cursor Bugbot for commit 1e5bee6. Configure here.