- GHO-27: mask secrets in ci mode, revert some changes instituted for testing, pass env vars to container without exposing them in an assignment but leveraging their exported nature

Author: noahwhite

.github/workflows/pr-tofu-fmt-check.yml

@@ -58,10 +58,9 @@ jobs:
       - name: Run tofu fmt check (recursive)
         run: |
           docker run --rm \
-            -e TF_VAR_cloudflare_account_id \
             -v "${GITHUB_WORKSPACE}:/home/devops/app" \
             -w /home/devops/app \
             ghcr.io/noahwhite/ghost-stack-shell:latest \
-            tofu fmt -check -recursive $TF_VAR_cloudflare_account_id
+            tofu fmt -check -recursive
 
 

docker/scripts/infra-shell.sh

@@ -174,69 +174,81 @@ fi
 
 if [[ "$USE_BWS" == "true" ]]; then
   # Retrieve into local variables (do not echo values)
-  #TF_VAR_cloudflare_api_token="$(get_bws_secret "59624245-6a0c-4fde-9d6d-b39c014882a6")"
+  TF_VAR_cloudflare_api_token="$(get_bws_secret "59624245-6a0c-4fde-9d6d-b39c014882a6")"
+  mask_value "$TF_VAR_cloudflare_api_token"
   TF_VAR_cloudflare_account_id="$(get_bws_secret "2fea4609-0d6b-4d8d-b9b5-b39b002de85b")"
   mask_value "$TF_VAR_cloudflare_account_id"
-  #R2_ACCESS_KEY_ID="$(get_bws_secret "9dfdf110-5a84-48c3-ad7e-b39b002afd6b")"
-  #R2_SECRET_ACCESS_KEY="$(get_bws_secret "f5d9794d-fd45-4dcb-9994-b39b002b5056")"
-  #TF_VAR_vultr_api_key="$(get_bws_secret "d68b6562-0d9e-424c-b2c5-b39c013ae34d")"
-  #TAILSCALE_API_KEY="$(get_bws_secret "34b620b7-edf6-4d06-9792-b39b00317467")"
-  #TAILSCALE_TAILNET="$(get_bws_secret "a8f07ce5-ed4d-42bb-b012-b39b00311d41")"
-  #PD_SUBDOMAIN="$(get_bws_secret "8ee84397-e563-4278-9a3f-b39c013f7575")"
-  #PD_CLIENT_ID="$(get_bws_secret "7d51661b-736a-43ff-b01f-b39c013fe49b")"
-  #PD_CLIENT_SECRET="$(get_bws_secret "b15575c0-0d28-459d-b92d-b39c01403a38")"
-  #PD_USER_TOK="$(get_bws_secret "02805292-4311-4290-9b6e-b39c01554ae6")"
-  #TF_VAR_GC_ACCESS_TOK="$(get_bws_secret "bfc8dd06-bd97-499a-98f8-b3a101570606")"
-  #TF_VAR_SOC_DEV_TERRAFORM_SA_TOK="$(get_bws_secret "3ebc4398-f4fa-448c-b2c1-b3a6006c063d")"
+  R2_ACCESS_KEY_ID="$(get_bws_secret "9dfdf110-5a84-48c3-ad7e-b39b002afd6b")"
+  mask_value "$R2_ACCESS_KEY_ID"
+  R2_SECRET_ACCESS_KEY="$(get_bws_secret "f5d9794d-fd45-4dcb-9994-b39b002b5056")"
+  mask_value "$R2_SECRET_ACCESS_KEY"
+  TF_VAR_vultr_api_key="$(get_bws_secret "d68b6562-0d9e-424c-b2c5-b39c013ae34d")"
+  mask_value "$TF_VAR_vultr_api_key"
+  TAILSCALE_API_KEY="$(get_bws_secret "34b620b7-edf6-4d06-9792-b39b00317467")"
+  mask_value "$TAILSCALE_API_KEY"
+  TAILSCALE_TAILNET="$(get_bws_secret "a8f07ce5-ed4d-42bb-b012-b39b00311d41")"
+  mask_value "$TAILSCALE_TAILNET"
+  PD_SUBDOMAIN="$(get_bws_secret "8ee84397-e563-4278-9a3f-b39c013f7575")"
+  mask_value "$PD_SUBDOMAIN"
+  PD_CLIENT_ID="$(get_bws_secret "7d51661b-736a-43ff-b01f-b39c013fe49b")"
+  mask_value "$PD_CLIENT_ID"
+  PD_CLIENT_SECRET="$(get_bws_secret "b15575c0-0d28-459d-b92d-b39c01403a38")"
+  mask_value "$PD_CLIENT_SECRET"
+  PD_USER_TOK="$(get_bws_secret "02805292-4311-4290-9b6e-b39c01554ae6")"
+  mask_value "$PD_USER_TOK"
+  TF_VAR_GC_ACCESS_TOK="$(get_bws_secret "bfc8dd06-bd97-499a-98f8-b3a101570606")"
+  mask_value "$TF_VAR_GC_ACCESS_TOK"
+  TF_VAR_SOC_DEV_TERRAFORM_SA_TOK="$(get_bws_secret "3ebc4398-f4fa-448c-b2c1-b3a6006c063d")"
+  mask_value "$TF_VAR_SOC_DEV_TERRAFORM_SA_TOK"
 
   echo "Successfully retrieved secrets from Bitwarden Secrets Manager"
 fi
 
 # Prompt for any required values not set by BWS (interactive only; CI will fail)
-#prompt_if_empty "TF_VAR_vultr_api_key" "Enter your Vultr API key: " true
-#prompt_if_empty "R2_ACCESS_KEY_ID" "Enter your R2 ACCESS KEY ID: " true
-#prompt_if_empty "R2_SECRET_ACCESS_KEY" "Enter your R2 SECRET ACCESS KEY: " true
-#prompt_if_empty "TF_VAR_cloudflare_api_token" "Enter your ghost-stack-dev Cloudflare API token: " true
+prompt_if_empty "TF_VAR_vultr_api_key" "Enter your Vultr API key: " true
+prompt_if_empty "R2_ACCESS_KEY_ID" "Enter your R2 ACCESS KEY ID: " true
+prompt_if_empty "R2_SECRET_ACCESS_KEY" "Enter your R2 SECRET ACCESS KEY: " true
+prompt_if_empty "TF_VAR_cloudflare_api_token" "Enter your ghost-stack-dev Cloudflare API token: " true
 prompt_if_empty "TF_VAR_cloudflare_account_id" "Enter your Cloudflare Account ID: " false
-#prompt_if_empty "TAILSCALE_API_KEY" "Enter your Tailscale API Key: " true
-#prompt_if_empty "TAILSCALE_TAILNET" "Enter your Tailscale TAILNET Name: " false
-#prompt_if_empty "PD_CLIENT_ID" "Enter your PagerDuty client id: " false
-#prompt_if_empty "PD_CLIENT_SECRET" "Enter your PagerDuty client secret: " true
-#prompt_if_empty "PD_SUBDOMAIN" "Enter your PagerDuty subdomain: " false
-#prompt_if_empty "PD_USER_TOK" "Enter your PagerDuty user API token: " true
-#prompt_if_empty "TF_VAR_GC_ACCESS_TOK" "Enter your Grafana Cloud access token: " true
-#prompt_if_empty "TF_VAR_SOC_DEV_TERRAFORM_SA_TOK" "Enter your Grafana Cloud SOC DEV Terraform access token: " true
+prompt_if_empty "TAILSCALE_API_KEY" "Enter your Tailscale API Key: " true
+prompt_if_empty "TAILSCALE_TAILNET" "Enter your Tailscale TAILNET Name: " false
+prompt_if_empty "PD_CLIENT_ID" "Enter your PagerDuty client id: " false
+prompt_if_empty "PD_CLIENT_SECRET" "Enter your PagerDuty client secret: " true
+prompt_if_empty "PD_SUBDOMAIN" "Enter your PagerDuty subdomain: " false
+prompt_if_empty "PD_USER_TOK" "Enter your PagerDuty user API token: " true
+prompt_if_empty "TF_VAR_GC_ACCESS_TOK" "Enter your Grafana Cloud access token: " true
+prompt_if_empty "TF_VAR_SOC_DEV_TERRAFORM_SA_TOK" "Enter your Grafana Cloud SOC DEV Terraform access token: " true
 
 # Export (and optionally write to $GITHUB_ENV) without printing values
-#export_var "TF_VAR_vultr_api_key" "${TF_VAR_vultr_api_key}"
-#export_var "R2_ACCESS_KEY_ID" "${R2_ACCESS_KEY_ID}"
-#export_var "R2_SECRET_ACCESS_KEY" "${R2_SECRET_ACCESS_KEY}"
+export_var "TF_VAR_vultr_api_key" "${TF_VAR_vultr_api_key}"
+export_var "R2_ACCESS_KEY_ID" "${R2_ACCESS_KEY_ID}"
+export_var "R2_SECRET_ACCESS_KEY" "${R2_SECRET_ACCESS_KEY}"
 export_var "TF_VAR_cloudflare_account_id" "${TF_VAR_cloudflare_account_id}"
-#export_var "TF_VAR_cloudflare_api_token" "${TF_VAR_cloudflare_api_token}"
-#export_var "CLOUDFLARE_API_TOKEN" "${TF_VAR_cloudflare_api_token}"
-#export_var "TAILSCALE_API_KEY" "${TAILSCALE_API_KEY}"
-#export_var "TAILSCALE_TAILNET" "${TAILSCALE_TAILNET}"
-#export_var "PD_CLIENT_ID" "${PD_CLIENT_ID}"
-#export_var "PD_CLIENT_SECRET" "${PD_CLIENT_SECRET}"
-#export_var "PD_SUBDOMAIN" "${PD_SUBDOMAIN}"
-#export_var "PD_USER_TOK" "${PD_USER_TOK}"
-#export_var "TF_VAR_GC_ACCESS_TOK" "${TF_VAR_GC_ACCESS_TOK}"
-#export_var "TF_VAR_SOC_DEV_TERRAFORM_SA_TOK" "${TF_VAR_SOC_DEV_TERRAFORM_SA_TOK}"
+export_var "TF_VAR_cloudflare_api_token" "${TF_VAR_cloudflare_api_token}"
+export_var "CLOUDFLARE_API_TOKEN" "${TF_VAR_cloudflare_api_token}"
+export_var "TAILSCALE_API_KEY" "${TAILSCALE_API_KEY}"
+export_var "TAILSCALE_TAILNET" "${TAILSCALE_TAILNET}"
+export_var "PD_CLIENT_ID" "${PD_CLIENT_ID}"
+export_var "PD_CLIENT_SECRET" "${PD_CLIENT_SECRET}"
+export_var "PD_SUBDOMAIN" "${PD_SUBDOMAIN}"
+export_var "PD_USER_TOK" "${PD_USER_TOK}"
+export_var "TF_VAR_GC_ACCESS_TOK" "${TF_VAR_GC_ACCESS_TOK}"
+export_var "TF_VAR_SOC_DEV_TERRAFORM_SA_TOK" "${TF_VAR_SOC_DEV_TERRAFORM_SA_TOK}"
 
 # Ensure required secrets are available
-#: "${TF_VAR_vultr_api_key:?Environment variable not set}"
-#: "${R2_ACCESS_KEY_ID:?Environment variable not set}"
-#: "${R2_SECRET_ACCESS_KEY:?Environment variable not set}"
+: "${TF_VAR_vultr_api_key:?Environment variable not set}"
+: "${R2_ACCESS_KEY_ID:?Environment variable not set}"
+: "${R2_SECRET_ACCESS_KEY:?Environment variable not set}"
 : "${TF_VAR_cloudflare_account_id:?Environment variable not set}"
-#: "${TF_VAR_cloudflare_api_token:?Environment variable not set}"
-#: "${TAILSCALE_API_KEY:?Environment variable not set}"
-#: "${TAILSCALE_TAILNET:?Environment variable not set}"
-#: "${PD_CLIENT_ID:?Environment variable not set}"
-#: "${PD_CLIENT_SECRET:?Environment variable not set}"
-#: "${PD_SUBDOMAIN:?Environment variable not set}"
-#: "${PD_USER_TOK:?Environment variable not set}"
-#: "${TF_VAR_GC_ACCESS_TOK:?Environment variable not set}"
-#: "${TF_VAR_SOC_DEV_TERRAFORM_SA_TOK:?Environment variable not set}"
+: "${TF_VAR_cloudflare_api_token:?Environment variable not set}"
+: "${TAILSCALE_API_KEY:?Environment variable not set}"
+: "${TAILSCALE_TAILNET:?Environment variable not set}"
+: "${PD_CLIENT_ID:?Environment variable not set}"
+: "${PD_CLIENT_SECRET:?Environment variable not set}"
+: "${PD_SUBDOMAIN:?Environment variable not set}"
+: "${PD_USER_TOK:?Environment variable not set}"
+: "${TF_VAR_GC_ACCESS_TOK:?Environment variable not set}"
+: "${TF_VAR_SOC_DEV_TERRAFORM_SA_TOK:?Environment variable not set}"
 
 # Exit early for CI secrets-only mode (no IP discovery, no SSH key, no docker actions)
 if [[ "$SECRETS_ONLY" == "true" ]]; then
@@ -283,7 +295,21 @@ fi
 # Run container if enabled
 if [[ "$RUN_CONTAINER" == "true" ]]; then
   HISTFILE=/dev/null HISTSIZE=0 HISTFILESIZE=0 docker run --rm -it \
-    -e TF_VAR_cloudflare_account_id="$TF_VAR_cloudflare_account_id" \
+    -e TF_VAR_vultr_api_key \
+    -e TF_VAR_cloudflare_account_id \
+    -e TF_VAR_cloudflare_api_token \
+    -e TF_VAR_ssh_public_key \
+    -e TF_VAR_admin_subnets \
+    -e R2_ACCESS_KEY_ID \
+    -e R2_SECRET_ACCESS_KEY \
+    -e TAILSCALE_API_KEY \
+    -e TAILSCALE_TAILNET \
+    -e TF_VAR_PD_CLIENT_ID \
+    -e TF_VAR_PD_CLIENT_SECRET \
+    -e TF_VAR_pd_subdomain \
+    -e TF_VAR_pd_user_tok \
+    -e TF_VAR_GC_ACCESS_TOK \
+    -e TF_VAR_SOC_DEV_TERRAFORM_SA_TOK \
     -e USER_UID="$(id -u)" \
     -e USER_GID="$(id -g)" \
     -e DISPLAY=$DISPLAY \