86d1531d52
- Replace plaintext tip (transceiver_db) and llm_gateway DB passwords with env-var references guarded by fail-fast checks, across 15 scripts + sql runbook. Covers quoted exports, unquoted psql calls, python env dicts and env-or-hardcoded-default fallbacks. - Untrack training-data/*.jsonl (~48MB, kept on disk) and gitignore *.jsonl. - Add .security-scan-allowlist for legit false positives: vendor name flexoptix, own homelab infra, sibling-project codenames in the sync journal, env-resolved DB URIs, example placeholders, ML tokenizer tokens. - Pre-push leak scanner goes from 397 to 0 findings, green without --no-verify. Follow-up (not in this commit): rotate the leaked values (llm_gateway first, tip fleet-wide coordinated); git history still holds the old passwords.
32 lines
1.9 KiB
Bash
32 lines
1.9 KiB
Bash
#!/bin/bash
|
|
# Run ON Erik: Fix enrichment SQL dedup + apply switches + restart
|
|
LOG="/tmp/deploy-all-fixes.log"
|
|
echo "$(date): Starting all fixes" > "$LOG"
|
|
|
|
# Step 1: Fix enrichment SQL (deduplicate columns)
|
|
echo "Step 1: Fixing enrichment SQL..." >> "$LOG"
|
|
python3 /tmp/fix-sql-dedup.py >> "$LOG" 2>&1
|
|
|
|
# Step 2: Re-apply enrichment
|
|
echo "Step 2: Applying enrichment..." >> "$LOG"
|
|
PGPASSWORD="${PGPASSWORD:?set PGPASSWORD}" psql -h localhost -p 5433 -U tip -d transceiver_db -f /tmp/011-flexoptix-enrichment.sql >> "$LOG" 2>&1
|
|
|
|
# Step 3: Apply switches SQL
|
|
echo "Step 3: Applying switches..." >> "$LOG"
|
|
PGPASSWORD="${PGPASSWORD:?set PGPASSWORD}" psql -h localhost -p 5433 -U tip -d transceiver_db -f /tmp/012-more-switches.sql >> "$LOG" 2>&1
|
|
|
|
# Step 4: Restart API
|
|
echo "Step 4: Restarting API..." >> "$LOG"
|
|
cd /opt/tip && pm2 restart tip-api >> "$LOG" 2>&1
|
|
|
|
# Step 5: Results
|
|
echo "" >> "$LOG"
|
|
echo "=== RESULTS ===" >> "$LOG"
|
|
PGPASSWORD="${PGPASSWORD:?set PGPASSWORD}" psql -h localhost -p 5433 -U tip -d transceiver_db -t -A -c "SELECT 'images: ' || count(*) FROM transceivers WHERE image_url IS NOT NULL" >> "$LOG" 2>&1
|
|
PGPASSWORD="${PGPASSWORD:?set PGPASSWORD}" psql -h localhost -p 5433 -U tip -d transceiver_db -t -A -c "SELECT 'connector: ' || count(*) FROM transceivers WHERE connector IS NOT NULL" >> "$LOG" 2>&1
|
|
PGPASSWORD="${PGPASSWORD:?set PGPASSWORD}" psql -h localhost -p 5433 -U tip -d transceiver_db -t -A -c "SELECT 'notes: ' || count(*) FROM transceivers WHERE notes IS NOT NULL AND notes != ''" >> "$LOG" 2>&1
|
|
PGPASSWORD="${PGPASSWORD:?set PGPASSWORD}" psql -h localhost -p 5433 -U tip -d transceiver_db -t -A -c "SELECT 'switches: ' || count(*) FROM switches" >> "$LOG" 2>&1
|
|
PGPASSWORD="${PGPASSWORD:?set PGPASSWORD}" psql -h localhost -p 5433 -U tip -d transceiver_db -t -A -c "SELECT 'sw_desc: ' || count(*) FROM switches WHERE description IS NOT NULL" >> "$LOG" 2>&1
|
|
|
|
echo "$(date): ALL DONE" >> "$LOG"
|