transceiver-db

rene.fichtmueller/transceiver-db

Fork 0

Commit Graph

Author	SHA1	Message	Date
Rene Fichtmueller	86d1531d52	fix(security): scrub hardcoded DB credentials, untrack training data, add scan allowlist - Replace plaintext tip (transceiver_db) and llm_gateway DB passwords with env-var references guarded by fail-fast checks, across 15 scripts + sql runbook. Covers quoted exports, unquoted psql calls, python env dicts and env-or-hardcoded-default fallbacks. - Untrack training-data/.jsonl (~48MB, kept on disk) and gitignore .jsonl. - Add .security-scan-allowlist for legit false positives: vendor name flexoptix, own homelab infra, sibling-project codenames in the sync journal, env-resolved DB URIs, example placeholders, ML tokenizer tokens. - Pre-push leak scanner goes from 397 to 0 findings, green without --no-verify. Follow-up (not in this commit): rotate the leaked values (llm_gateway first, tip fleet-wide coordinated); git history still holds the old passwords.	2026-07-07 12:06:07 +02:00
Rene Fichtmueller	6f7c834752	feat(scrapers+mcp): ATGBICS + ProLabs scrapers, MCP HTTP/SSE server Scrapers: - atgbics.ts: PlaywrightCrawler for UK vendor ATGBICS (Shopify store), scrapes SFP/SFP+/SFP28/QSFP+/QSFP28/QSFP-DD in GBP, max 50 pages/run - prolabs.ts: HttpCrawler for ProLabs (Legrand subsidiary), USD pricing, category-driven crawl with reach/fiber/speed detection - Both registered in scheduler (every 8h, staggered) and index.ts CLI MCP HTTP Server: - packages/mcp-server/src/http-server.ts: Express + SSEServerTransport - Exposes all 12 TIP tools via GET /sse + POST /message - Bearer token auth (MCP_SECRET env), CORS-configurable - GET /health → { status: "ok", tools: 12 } - Port: MCP_HTTP_PORT (default 3201) SQL + tools: - sql/006-009: seed scripts for whitebox switches, vendors, assets - switch-docs.ts: MCP tool for switch documentation queries	2026-03-29 02:26:45 +08:00

Author

SHA1

Message

Date

Rene Fichtmueller

86d1531d52

fix(security): scrub hardcoded DB credentials, untrack training data, add scan allowlist

- Replace plaintext tip (transceiver_db) and llm_gateway DB passwords with
  env-var references guarded by fail-fast checks, across 15 scripts + sql runbook.
  Covers quoted exports, unquoted psql calls, python env dicts and
  env-or-hardcoded-default fallbacks.
- Untrack training-data/*.jsonl (~48MB, kept on disk) and gitignore *.jsonl.
- Add .security-scan-allowlist for legit false positives: vendor name flexoptix,
  own homelab infra, sibling-project codenames in the sync journal, env-resolved
  DB URIs, example placeholders, ML tokenizer tokens.
- Pre-push leak scanner goes from 397 to 0 findings, green without --no-verify.

Follow-up (not in this commit): rotate the leaked values (llm_gateway first,
tip fleet-wide coordinated); git history still holds the old passwords.

2026-07-07 12:06:07 +02:00

Rene Fichtmueller

6f7c834752

feat(scrapers+mcp): ATGBICS + ProLabs scrapers, MCP HTTP/SSE server

Scrapers:
- atgbics.ts: PlaywrightCrawler for UK vendor ATGBICS (Shopify store),
  scrapes SFP/SFP+/SFP28/QSFP+/QSFP28/QSFP-DD in GBP, max 50 pages/run
- prolabs.ts: HttpCrawler for ProLabs (Legrand subsidiary), USD pricing,
  category-driven crawl with reach/fiber/speed detection
- Both registered in scheduler (every 8h, staggered) and index.ts CLI

MCP HTTP Server:
- packages/mcp-server/src/http-server.ts: Express + SSEServerTransport
- Exposes all 12 TIP tools via GET /sse + POST /message
- Bearer token auth (MCP_SECRET env), CORS-configurable
- GET /health → { status: "ok", tools: 12 }
- Port: MCP_HTTP_PORT (default 3201)

SQL + tools:
- sql/006-009: seed scripts for whitebox switches, vendors, assets
- switch-docs.ts: MCP tool for switch documentation queries

2026-03-29 02:26:45 +08:00

2 Commits