Fix/security and correctness

.env_example

@@ -1,6 +1,8 @@
 OPENBAO_ADDR=https://openbao:8200
 OPENBAO_TOKEN=example_token
 OPENBAO_UNSEAL_KEY=example_key
+# Path to a CA cert for verifying OpenBao TLS. Leave empty to use the system trust store (e.g. for Let's Encrypt certs).
+OPENBAO_CA_CERT=/snykey/certs/ca/ca.crt
 REDIS_HOST=redis
 REDIS_PORT=6379
 REDIS_PASSWORD=example_password

.github/workflows/site.yml

@@ -22,8 +22,8 @@ jobs:
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          pip install -r ./docs/requirements.txt
+          python -m pip install uv
+          uv pip install -r ./docs/requirements.txt
 
       - name: Build MkDocs site
         run: mkdocs build

.gitignore

@@ -170,3 +170,7 @@ temp/
 
 # Just for now
 docs/examples/snykey.py
+
+# Ignore private keys and certificates
+*.key
+*.pem

Dockerfile

@@ -1,5 +1,7 @@
 FROM ghcr.io/astral-sh/uv:python3.13-alpine
 
+RUN apk add --no-cache curl
+
 RUN addgroup -g 1001 -S snykey && \
     adduser -u 1001 -S snykey -G snykey
 

configs/bao_config.hcl

@@ -14,7 +14,7 @@
     }
   },
   "default_lease_ttl": "168h",
-  "max_lease_ttl": "0h",
+  "max_lease_ttl": "720h",
   "ui": true,
-  "log_level": "Debug"
+  "log_level": "Info"
 }

configs/redis_config.conf

@@ -1,5 +1,5 @@
 port 6379
-loglevel debug
+loglevel notice
 bind 0.0.0.0
 
 requirepass example_password

docker-compose.yml

@@ -17,6 +17,7 @@ services:
     environment:
       - OPENBAO_ADDR=${OPENBAO_ADDR}
       - OPENBAO_TOKEN=${OPENBAO_TOKEN}
+      - OPENBAO_CA_CERT=${OPENBAO_CA_CERT}
       - REDIS_HOST=${REDIS_HOST}
       - REDIS_PORT=${REDIS_PORT}
       - REDIS_PASSWORD=${REDIS_PASSWORD}
@@ -28,6 +29,12 @@ services:
       - ./.container_volumes/app/logs:/snykey/logs:rw,Z
       - ./.container_volumes/certs/app:/snykey/certs:rw,z
       - ./.container_volumes/certs/ca:/snykey/certs/ca:rw,z
+    healthcheck:
+      test: ["CMD", "curl", "-k", "-f", "https://localhost:8000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
     depends_on:
       - openbao
       - redis
@@ -38,8 +45,6 @@ services:
   redis:
     image: "redis:latest"
     container_name: redis
-    ports:
-      - "6379:6379"
     volumes:
       - ./.container_volumes/redis/data:/data:rw,Z
       - ./.container_volumes/redis/config/redis.conf:/etc/redis.conf:ro,Z
@@ -52,8 +57,6 @@ services:
   openbao:
     image: "openbao/openbao:latest"
     container_name: openbao
-    ports:
-      - "8200:8200"
     environment:
       - OPENBAO_ENV=development
       - BAO_ADDR=https://127.0.0.1:8200

docs/getting-started/configuration.md

@@ -6,18 +6,19 @@ Snykey is highly configurable to fit a variety of deployment environments. Below
 
 Most configuration is handled via environment variables, typically set in your `.env` file or passed directly to Docker Compose. See `.env_example` for a template.
 
-| Variable            | Description                                              | Default/Example         |
-|---------------------|---------------------------------------------------------|-------------------------|
-| `OPENBAO_ADDR`      | URL for the OpenBao server                              | `https://openbao:8200`  |
-| `OPENBAO_TOKEN`     | Root token for OpenBao                                  | *(set after init)*      |
-| `OPENBAO_UNSEAL_KEY`| Unseal key for OpenBao                                  | *(set after init)*      |
-| `REDIS_HOST`        | Hostname for Redis                                      | `redis`                 |
-| `REDIS_PORT`        | Port for Redis                                          | `6379`                  |
-| `REDIS_PASSWORD`    | Password for Redis                                      | `example_password`      |
-| `REDIS_CACHE_TIME`  | Cache time (in seconds) for Redis tokens                | `3000`                  |
-| `REDIS_PKCE_EXPIRATION`| Cache time (in seconds) for app registration uri to have valid callback | `600`|
-| `EXCLUDED_PATHS`    | Comma seperated endpoints to ignore middleware for      | `/docs,/openapi.json`   |
-| `API_KEY`           | The key required for middleware, uses the header: 'X-API-Key'. To disable, remove the entry | `example_api_key_1234567890` |
+| Variable | Description | Default/Example |
+|---|---|---|
+| `OPENBAO_ADDR` | URL for the OpenBao server | `https://openbao:8200` |
+| `OPENBAO_TOKEN` | Root token for OpenBao | *(set after init)* |
+| `OPENBAO_UNSEAL_KEY` | Unseal key for OpenBao | *(set after init)* |
+| `OPENBAO_CA_CERT` | Path to a CA cert for verifying OpenBao TLS. Leave empty to use the system trust store (e.g. for Let's Encrypt or mkcert) | *(empty)* |
+| `REDIS_HOST` | Hostname for Redis | `redis` |
+| `REDIS_PORT` | Port for Redis | `6379` |
+| `REDIS_PASSWORD` | Password for Redis | `example_password` |
+| `REDIS_CACHE_TIME` | Cache time (in seconds) for Redis tokens | `3000` |
+| `REDIS_PKCE_EXPIRATION` | Cache time (in seconds) for PKCE data during app registration | `600` |
+| `EXCLUDED_PATHS` | Comma-separated endpoints to bypass API key middleware | `/docs,/openapi.json,/v1/callback` |
+| `API_KEY` | The key required by middleware, sent via the `X-API-Key` header. Remove the entry to disable authentication | `example_api_key_1234567890` |
 
 You can modify these in your `.env` file or override them in your deployment environment.
 
@@ -29,7 +30,7 @@ Redis is configured via [`configs/redis_config.conf`](../configs/redis_config.co
 You can adjust:
 
 - **Port**: Change the `port` directive.
-- **Password**: Set `requirepass` to your desired password.
+- **Password**: Set `requirepass` to your desired password. This must match `REDIS_PASSWORD` in your `.env`.
 - **Persistence**: Adjust `appendonly` and `appendfsync` for durability/performance.
 - **Logging**: Change `loglevel` as needed.
 

docs/getting-started/installation.md

@@ -12,72 +12,100 @@ cd snykey
 ```
 
 ## 2. Prepare Configuration
-Copy .env_example to .env and fill in your secrets and environment-specific values.
-Adjust any configuration in configs/ if needed.
 
-## 3. Run the Setup Scripts
-The setup scripts will:
+Copy `.env_example` to `.env` and fill in your values. You won't have the OpenBao token or unseal key yet — that comes after initialization in step 6.
 
-* Create required directories and volume mounts
-* Copy configuration files for OpenBao and Redis
-* Generate self-signed certificates for local development
+```bash
+cp .env_example .env
+```
 
-Run: `python3 ./scripts/setup.py`
-Run: `python3 ./scripts/genreate_certs.py`
+## 3. Run the Setup Script
 
-## 4. Set the configuration
-The setup needs an initial configuration .env file. You dont need to know the OPENBAO details just yet.
+Creates the required directory structure and copies configuration files for OpenBao and Redis.
 
 ```bash
-cp .env_example .env
+python3 ./scripts/setup.py
+```
+
+## 4. Place TLS Certificates
+
+Snykey and OpenBao both require TLS certificates. Place them in the directories created by the setup script:
+
+| Path | Contents |
+|------|----------|
+| `.container_volumes/certs/ca/ca.crt` | CA certificate (used to verify OpenBao) |
+| `.container_volumes/certs/bao/bao.crt` | OpenBao server certificate |
+| `.container_volumes/certs/bao/bao.key` | OpenBao server key |
+| `.container_volumes/certs/app/app.crt` | App server certificate |
+| `.container_volumes/certs/app/app.key` | App server key |
+
+For local development, [`mkcert`](https://github.com/FiloSottile/mkcert) is the easiest way to generate trusted certificates:
+
+```bash
+mkcert -install
+mkcert -cert-file .container_volumes/certs/bao/bao.crt \
+       -key-file  .container_volumes/certs/bao/bao.key \
+       openbao localhost 127.0.0.1
+mkcert -cert-file .container_volumes/certs/app/app.crt \
+       -key-file  .container_volumes/certs/app/app.key \
+       app localhost 127.0.0.1
+cp "$(mkcert -CAROOT)/rootCA.pem" .container_volumes/certs/ca/ca.crt
 ```
 
+For production, use certificates from your organization's CA or a public provider. Set `OPENBAO_CA_CERT` in `.env` if OpenBao uses a certificate not trusted by the system store.
+
 ## 5. Start the Stack
-Start all services with Docker Compose:
 
 ```bash
 docker compose up -d --build
 ```
 
 ## 6. Initialize and Unseal OpenBao
+
 ### a. Initialize OpenBao (first time only):
+
 ```bash
 docker exec -it openbao bao operator init -n 1 -t 1
 ```
 
-* Save the Unseal Key and Root Token from the output.
-* Add them to your .env file as OPENBAO_UNSEAL_KEY and OPENBAO_TOKEN.
+Save the **Unseal Key** and **Root Token** from the output, then add them to your `.env` file:
 
-### b. Restart the Stack
-```bash
-docker compose down
 ```
+OPENBAO_UNSEAL_KEY=<unseal key>
+OPENBAO_TOKEN=<root token>
+```
+
+### b. Restart the Stack
 
 ```bash
-docker compose up -d
+docker compose restart
 ```
 
 ### c. Unseal OpenBao:
+
 ```bash
 docker exec -it openbao bao operator unseal $OPENBAO_UNSEAL_KEY
 ```
 
 ### d. Login to OpenBao:
+
 ```bash
 docker exec -it openbao bao login $OPENBAO_TOKEN
 ```
 
 ## 7. Enable the Key-Value Secrets Engine
-Enable the KV secrets engine (version 2):
 
 ```bash
 docker exec -it openbao bao secrets enable -version=2 kv
 ```
 
+(If that doesn't work, try: `docker exec -it openbao sh -c 'unset BAO_TOKEN && bao secrets enable -version=2 kv'`)
+
 ## 8. (Optional) Verify Everything is Running
-* Visit `https://localhost:8000/docs` for the API docs.
-* Check logs in .container_volumes/app/logs/ if needed.
+
+- Visit `https://localhost:8000/docs` for the API docs.
+- Check logs in `.container_volumes/app/logs/` if needed.
 
 ## 9. Next Steps
-* Use the API to store and retrieve Snyk credentials for your applications.
-* For production, replace the generated certificates with your own trusted certificates.
+
+- Use the API to store and retrieve Snyk credentials for your applications.