22 lines
1.3 KiB
Markdown
22 lines
1.3 KiB
Markdown
|
---
|
||
|
|
created: 2026-07-30T22:19:31.770Z
|
||
|
|
title: Fedimint gateway must not install with a pre-set password
|
||
|
|
area: security
|
||
|
|
severity: blocker
|
||
|
|
files:
|
||
|
|
- core/archipelago/src (app orchestrator / secrets materialisation)
|
||
|
|
---
|
||
|
|
|
||
|
|
## Problem
|
||
|
|
|
||
|
|
Dorian reports (2026-07-30): the Fedimint gateway app installs with a password already set up — i.e. a default/pre-baked credential rather than one generated at install time or set by the user. Default credentials on a Lightning/fedimint gateway are a security hole: anyone knowing the shipped default can access the gateway. Dorian rated this a blocker.
|
||
|
|
|
||
|
|
This also violates the repo's standing secrets invariant (CLAUDE.md): secrets must be manifest-declared (`generated_secrets`, materialised by `container::secrets`, 0600/rootless) — never hardcoded or per-app baked in.
|
||
|
|
|
||
|
|
## Solution
|
||
|
|
|
||
|
|
Tracked as requirement **FED-07** (Phase 1, ROADMAP success criterion 7 — needs a gap plan since phase 1's 10 plans predate it):
|
||
|
|
- Find where the fedimint gateway app's manifest/install path sets its password (check `/opt/archipelago/apps/*/manifest.yml` for the gateway, and the orchestrator's secrets materialisation).
|
||
|
|
- Move it to `generated_secrets` so each install gets a unique credential, or require explicit user setup.
|
||
|
|
- Migration path for existing installs still carrying the default password (migrations must never destroy data).
|