fix(api)!: authenticate and authorize the GraphQL API; bind loopback by default

.env.example

@@ -29,6 +29,17 @@ DATABASE_URL=postgres://echidnabot:changeme@postgres:5432/echidnabot
 # mapping in compose.yml if you need something else.
 ECHIDNABOT__SERVER__HOST=0.0.0.0
 ECHIDNABOT__SERVER__PORT=8080
+
+# GraphQL API credentials. REQUIRED here: the container binds 0.0.0.0, and
+# the daemon refuses a non-loopback bind without at least one of them.
+# Each at least 32 bytes, the two different: `openssl rand -hex 32`.
+#   ECHIDNABOT_API_ROUTE_TOKEN  submitProofObligation only, for [api] route_repos
+#                               (the credential Hypatia holds)
+#   ECHIDNABOT_API_ADMIN_TOKEN  every GraphQL query and mutation
+# ECHIDNABOT_API_ROUTE_TOKEN=
+# ECHIDNABOT_API_ADMIN_TOKEN=
+# The repositories the route credential may submit for are set in
+# echidnabot.toml: [api] route_repos = ["hyperpolymath/*"].
 RUST_LOG=info
 
 # ─── ECHIDNA prover orchestrator (REST endpoint) ────────────────────────

docs/content/configuration.adoc

@@ -13,10 +13,15 @@ The main configuration file, located in your repository root or at
 ----
 # Server configuration
 [server]
-host = "0.0.0.0"
+host = "127.0.0.1"  # a non-loopback host needs API credentials
 port = 8080
 workers = 4
 
+# GraphQL API access (credentials come from the environment only)
+[api]
+route_repos = ["hyperpolymath/*"]  # "owner/name" or "owner/*"
+rate_limit_rpm = 120                # per TCP peer address; 0 disables
+
 # Database configuration
 [database]
 # SQLite (development)
@@ -66,6 +71,8 @@ webhook_secret = "${GITLAB_WEBHOOK_SECRET}"
 |`+ECHIDNABOT_ECHIDNA_ENDPOINT+` |ECHIDNA Core GraphQL endpoint |Yes
 |`+ECHIDNABOT_ECHIDNA_REST_ENDPOINT+` |ECHIDNA Core REST endpoint |No
 |`+ECHIDNABOT_ECHIDNA_MODE+` |ECHIDNA API mode (auto/graphql/rest) |No
+|`+ECHIDNABOT_API_ROUTE_TOKEN+` |Bearer credential for `submitProofObligation` only, limited to `[api] route_repos`; at least 32 bytes |To submit obligations
+|`+ECHIDNABOT_API_ADMIN_TOKEN+` |Bearer credential for every GraphQL query and mutation; at least 32 bytes, distinct from the route credential |To use the API
 |`+GITHUB_WEBHOOK_SECRET+` |GitHub webhook secret |For GitHub
 |`+GITHUB_APP_ID+` |GitHub App ID |For GitHub
 |`+GITHUB_PRIVATE_KEY+` |GitHub App private key (PEM) |For GitHub

echidnabot.example.toml

@@ -2,11 +2,27 @@
 # Copy to echidnabot.toml and customize
 
 [server]
-# Host to bind to (0.0.0.0 for all interfaces)
-host = "0.0.0.0"
+# Host to bind to. Loopback by default. Binding every interface
+# ("0.0.0.0") needs ECHIDNABOT_API_ROUTE_TOKEN and/or
+# ECHIDNABOT_API_ADMIN_TOKEN in the environment, or the daemon refuses to start.
+host = "127.0.0.1"
 # Port to listen on
 port = 8080
 
+[api]
+# The GraphQL API at /graphql needs a bearer credential. The two credentials
+# are read only from the environment, never from this file:
+#   ECHIDNABOT_API_ROUTE_TOKEN  submitProofObligation only, for route_repos
+#   ECHIDNABOT_API_ADMIN_TOKEN  every query and mutation
+# Each must be at least 32 bytes and they must differ: `openssl rand -hex 32`.
+# Repositories the route credential may submit for: "owner/name" or "owner/*".
+# Empty allows none.
+route_repos = ["hyperpolymath/*"]
+# /graphql requests per minute per TCP peer address (0 disables). The peer is
+# the address that connected, so behind a reverse proxy every client shares
+# the proxy's budget: limit at the proxy instead and set 0 here.
+rate_limit_rpm = 120
+
 [database]
 # SQLite for development, PostgreSQL for production
 # SQLite: sqlite://path/to/db.sqlite