mcp-servers/gitea-mcp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(security): require Gitea tokens via env vars

Browse Source 
Removed BUILTIN_TOKEN (dev) and the hardcoded prod/nautilus tokens
from BUILTIN_SERVERS. install.sh now refuses to run if
GITEA_DEFAULT_TOKEN, GITEA_PROD_TOKEN, or GITEA_NAUTILUS_TOKEN env
vars are missing.

Why: discovered during the LegalCrm 2026-04-25 security audit. Per
the Infisical-only secrets policy, tokens MUST come from Infisical
(/gitea per-environment → API_TOKEN), never baked into source. The
script was previously a public credential dump for all three
production Gitea instances.

Run with the env vars set before re-installing:
  GITEA_DEFAULT_TOKEN=<dev> GITEA_PROD_TOKEN=<prod> GITEA_NAUTILUS_TOKEN=<nautilus> ./install.sh

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chaim Marcus
2026-04-25 21:10:32 +00:00
parent 12f0e872c1
commit a519798e69
1 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install.sh
+21 -5
View File
@@ -313,17 +313,33 @@ if [ -n "$EXISTING_ENTRY" ]; then
fi
fi
# Determine default host and token (env vars > existing > built-in defaults)
# Determine default host and token (env vars > existing config; no built-in token).
# Per Infisical-only secrets policy, tokens MUST come from env vars at install time.
# Source values from Infisical /gitea (per environment) before re-running this script.
BUILTIN_HOST="https://gitea.dev.marcus-law.co.il"
BUILTIN_TOKEN="90acb3ebc0f98edfb7a373ef9902bde1cc8eff96"
DEFAULT_HOST="${GITEA_DEFAULT_HOST:-${CURRENT_HOST:-$BUILTIN_HOST}}"
DEFAULT_TOKEN="${GITEA_DEFAULT_TOKEN:-${CURRENT_TOKEN:-$BUILTIN_TOKEN}}"
DEFAULT_TOKEN="${GITEA_DEFAULT_TOKEN:-${CURRENT_TOKEN:-}}"
if [[ -z "$DEFAULT_TOKEN" ]]; then
err "No token resolved for default server. Set GITEA_DEFAULT_TOKEN env var (Infisical /gitea dev → API_TOKEN) and re-run."
exit 1
fi
ok "Default server: $DEFAULT_HOST"
# Built-in additional servers
BUILTIN_SERVERS='{"prod":{"host":"https://gitea.prod.marcus-law.co.il","token":"44254bf41fb8eba17b467d46bbac792db5b57333","insecure":false},"nautilus":{"host":"https://gitea.nautilus.marcusgroup.org","token":"17c8a6ea2af0b9a1d27d6fdceaf65b2d8ebc4a66","insecure":false}}'
# Built-in additional server hosts (no tokens — those come from env vars).
# Set GITEA_PROD_TOKEN and GITEA_NAUTILUS_TOKEN env vars (Infisical /gitea prod|nautilus → API_TOKEN).
BUILTIN_SERVERS_TEMPLATE='{"prod":{"host":"https://gitea.prod.marcus-law.co.il","token":"__PROD_TOKEN__","insecure":false},"nautilus":{"host":"https://gitea.nautilus.marcusgroup.org","token":"__NAUTILUS_TOKEN__","insecure":false}}'
if [[ -z "${GITEA_PROD_TOKEN:-}" || -z "${GITEA_NAUTILUS_TOKEN:-}" ]]; then
err "GITEA_PROD_TOKEN and GITEA_NAUTILUS_TOKEN env vars are required for the additional-servers template."
err "Source values from Infisical /gitea prod and /gitea nautilus, then re-run."
exit 1
fi
BUILTIN_SERVERS="${BUILTIN_SERVERS_TEMPLATE//__PROD_TOKEN__/$GITEA_PROD_TOKEN}"
BUILTIN_SERVERS="${BUILTIN_SERVERS//__NAUTILUS_TOKEN__/$GITEA_NAUTILUS_TOKEN}"
# ── Step 6: Add additional servers ─────────────────────────────────────────