trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix picomatch audit vulnerability and complete security hardening verification

Browse source 
Override picomatch to 4.0.4 to resolve high-severity ReDoS (GHSA-c2c7-rcm5-vvqj),
verify all security hardening tasks (gitleaks, pnpm audit, Docker non-root,
Caddy headers, scanner blocking), sync specs, and archive the change.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-03-26 00:31:27 +01:00
parent 433886772f
commit b6908fb288
No known key found for this signature in database
GPG key ID: A32FF691A0F752D9
10 changed files with 604 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

20
openspec/specs/infrastructure/spec.md
View file

@ -15,7 +15,7 @@ All services SHALL be deployed via Docker Compose on the Hetzner server.
- **THEN** the Journal, Planner, BRouter, PostgreSQL, and Garage containers start and are reachable
### Requirement: Service configuration
Each service SHALL be configured via environment variables defined in Docker Compose.
Each service SHALL be configured via environment variables defined in Docker Compose, with security best practices including non-root execution and security headers.
#### Scenario: Journal configuration
- **WHEN** the Journal container starts
@ -25,6 +25,14 @@ Each service SHALL be configured via environment variables defined in Docker Com
- **WHEN** the Planner container starts
- **THEN** it reads BROUTER_URL and DATABASE_URL from environment variables
#### Scenario: Caddy security headers
- **WHEN** Caddy proxies a request
- **THEN** it adds HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers
#### Scenario: Caddy scanner blocking
- **WHEN** a request matches known scanner paths (.env, .git, wp-config, etc.)
- **THEN** Caddy returns 403 without forwarding to the application
### Requirement: PostgreSQL with PostGIS
The database SHALL be PostgreSQL with the PostGIS extension for spatial queries.
@ -44,12 +52,20 @@ The infrastructure SHALL support downloading and updating Germany RD5 segments f
- **THEN** RD5 segments are updated from brouter.de and the BRouter container is restarted
### Requirement: CI/CD pipeline
GitHub Actions SHALL build and deploy both apps on push to main.
GitHub Actions SHALL build, deploy, and security-scan both apps on push to main.
#### Scenario: Push triggers deployment
- **WHEN** code is pushed to the main branch
- **THEN** GitHub Actions builds Docker images, pushes to ghcr.io/trails-cool/, and deploys to the Hetzner server
#### Scenario: Gitleaks scan
- **WHEN** a PR is opened
- **THEN** gitleaks scans for committed secrets
#### Scenario: Dependency audit
- **WHEN** CI runs
- **THEN** pnpm audit checks for high/critical vulnerabilities
### Requirement: Backup strategy
The infrastructure SHALL include daily backups of the PostgreSQL database.