davideandClaude Sonnet 5.5
c1b192f6d1
- app runs as uid 1000; a one-shot data-permissions service chowns ./data to it and closes it to others (works on an older root-owned install with no host sudo); files are created 0600 (umask 077) - python:3.12-slim and caddy:2-alpine pinned by digest; dependencies installed from requirements.lock with --require-hashes - the Fernet key is XPRV_ENCRYPTION_KEY_FILE (./secrets/xprv_encryption.key, a compose secret), out of every environment variable and of a ./data backup - setup.md no longer presents a second way to run the server (B-72) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
22 lines
970 B
Python
22 lines
970 B
Python
"""One-time ops bootstrap: generate and encrypt the server's master xprv.
|
|
|
|
Usage:
|
|
python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
# write it to the file XPRV_ENCRYPTION_KEY_FILE (.env) points at, then:
|
|
python scripts/generate_master_key.py
|
|
"""
|
|
|
|
from app.config import settings
|
|
from app.wallet.hd import generate_master_key
|
|
from app.wallet.verify import load_sample
|
|
|
|
if __name__ == "__main__":
|
|
if not settings.xprv_encryption_key:
|
|
raise SystemExit("XPRV_ENCRYPTION_KEY_FILE is not set, or its file is missing or empty")
|
|
sample = load_sample()
|
|
if sample.users or sample.rounds or sample.seeds:
|
|
# SEC-50: a new key cannot reproduce the addresses the database already holds.
|
|
raise SystemExit("the database already has users or rounds: a new key would not reproduce their addresses")
|
|
generate_master_key()
|
|
print(f"Master key written (encrypted) to {settings.master_key_path}")
|