Security and correctness hardening pass

[solomonneas]

Security and correctness hardening pass

A read-only audit of the installer (which runs as root and provisions LXCs) turned up real weaknesses the existing tests did not catch. This branch fixes them. The baseline was already green; every change here is gated through ./scripts/verify and covered by new unit tests where testable. Unit tests went from 105 to 123.

Base note: this branch stacks on the unmerged docs/adoption-upgrade work, so the diff includes those 3 base commits plus the 6 harden(...) commits that are the actual change. Retarget the base if you prefer.

Security

• Enforce the MCP bearer token. The per-server token was advertised to clients but never enforced, because mcp-proxy has no server-side auth. The 9 SSE endpoints (admin-reach tools) accepted unauthenticated requests while the docs implied otherwise. Each endpoint is now fronted by an nginx gateway that returns 401 unless the Authorization header is the exact token; mcp-proxy binds loopback behind it. Docs corrected to match; installer warns on a non-loopback bind.
• Gate the self-hosted CI runner to non-fork PRs. integration-component ran on the self-hosted Proxmox runner for every PR with no fork guard, and the runner account has broad host sudo. Added an if: so only same-repo PRs and pushes reach it; pinned actions/checkout to a commit SHA; added permissions: contents: read.
• Remove the dead legacy installer tree (scripts/setup/**). It was excluded from the shellcheck gate and carried TLS-off alert forwarding, an installer fetched from a mutable branch and run as root, cleartext password printing, and an allow-all firewall. Nothing live referenced it.
• Keep credentials off process argv during provisioning (readable via /proc): the LXC root password is set via chpasswd over stdin, and the TheHive/Cortex API calls use curl --data @-, matching the pattern MISP already used.
• Broadened result-JSON redaction (more key names plus credentials embedded in URL values), a full-length random Cortex password salt, and parsing the optional rapid7.env/sophos.env as data instead of sourcing them as shell.
• Pinned the MISP images by digest, and repointed + pinned the dashboards sources (the old repo URLs were stale: one was renamed, one no longer resolved, so that component was failing to clone). See the caveat below.

Correctness

• gen_password returned exit 141 on success under set -o pipefail (a tr | head SIGPIPE), a latent abort for any set -e caller. Reproduced and fixed.
• state_set overwrote a good state file with empty content when jq failed, breaking idempotency. It now only replaces on success, tolerates a corrupt file instead of aborting, and writes the temp file in the target directory for an atomic rename.
• --ip-mode static set no gateway, so static containers had no default route and failed the network wait. Added a --gateway flag (defaults to the first host of the range).
• --vlan was validated and stored but never applied to the container network config.
• Static IPs were allocated by selection index, so component subsets and re-runs collided on the same address. They now key off the component's canonical ordinal.
• A successful deploy now records status=deployed authoritatively, so it is not re-deployed on every re-run.
• --flag=value is accepted; validate_manifest exact-matches component names.

Testing

./scripts/verify passes (134 unit tests, shellcheck clean, manifests valid). New coverage fills gaps the audit flagged: the destroy path (lxc_destroy/lxc_stop/lxc_push_script and a component destroy.sh), the deploy_one static-IP failure branch, and --include-secrets-json redact-vs-emit.

Validation done (off-host), plus one remaining live check

Both items that needed verification were tested locally:

• MCP auth gateway — validated. The generated nginx config was reproduced on loopback against a dummy backend: nginx -t clean; no Authorization header → 401; wrong token → 401; correct token → 200 proxied to the backend. The bearer token is genuinely enforced now.
• Dashboard sources — confirmed and fixed. hotwash is the Playbook Forge successor (its build even emits a flowchart chunk). Testing surfaced that vervet and hotwash now have different build layouts (vervet's package.json moved to the repo root), so the single cd web && npm install && vite build pattern was still wrong for vervet. The build commands were corrected and re-validated against the pinned commits: both produce web/dist/index.html and vite preview serves them (HTTP 200).

Remaining live check (needs a Proxmox host): the in-LXC deploy plumbing can't be exercised off-host — that mcp-proxy binds 127.0.0.1:<port+10000> behind nginx and its systemd unit starts, and that the dashboards vite preview units come up. One-shot smoke test after deploying mcp and dashboards:

# MCP auth is enforced (mcp-ip from /root/soc-stack.json)
curl -s -o /dev/null -w '%{http_code}\n' http://<mcp-ip>:3001/sse                         # expect 401
TOK=$(jq -r '.raw_endpoints[] | select(.url|contains(":3001")) | .token' /root/mcp-clients.json)
curl -s -o /dev/null -w '%{http_code}\n' -H "Authorization: Bearer ${TOK}" http://<mcp-ip>:3001/sse  # expect 2xx, not 401
# Dashboards build + serve
curl -s -o /dev/null -w '%{http_code}\n' http://<dash-ip>/bro-hunter/                      # expect 200
curl -s -o /dev/null -w '%{http_code}\n' http://<dash-ip>/playbook-forge/                  # expect 200