Fix insecure defaults: enforce required secrets in docker-compose and expand insecure-key blocklist

[Copilot]

docker-compose.yml silently fell back to hardcoded secrets when JWT_SECRET/ENCRYPTION_KEY were unset — and the encryption fallback (change-this-16-char-key-for-prod) wasn't in the validator's blocklist, so it bypassed StartupSecurityValidator entirely.

Changes

• docker-compose.yml: Replace :- fallback defaults with :? error syntax — docker-compose now aborts with an actionable message if either variable is unset:

  JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set (generate with: openssl rand -base64 32)}
  ENCRYPTION_KEY: ${ENCRYPTION_KEY:?ENCRYPTION_KEY must be set (generate with: openssl rand -base64 32)}

• StartupSecurityValidator.kt: Add change-this-16-char-key-for-prod to INSECURE_ENCRYPTION_DEFAULTS as defence-in-depth, covering the case where the old docker-compose default is passed via other means.

• StartupSecurityValidatorTest.kt: Add test asserting the docker-compose fallback encryption key is rejected by the validator.

The rest of the security hardening (application.yml empty defaults, @Profile("!test") validator skip, README key-generation docs) was already in place on main.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -Dorg.gradle.internal.worker.tmpdir=/home/REDACTED/work/OpenDataMask/OpenDataMask/backend/build/tmp/test/work -Dorg.gradle.native=false -javaagent:/home/REDACTED/work/OpenDataMask/OpenDataMask/backend/build/tmp/.cache/expanded/zip_0bd0851504e6286cb5fc6f37a81e25cc/jacocoagent.jar=destfile=build/jacoco/test.exec,append=true,inclnolocationclasses=false,dumponexit=true,output=file,jmx=false @/home/REDACTED/.gradle/.tmp/gradle-worker-classpath12441040706244866342txt -Xmx512m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -ea worker.org.gradle.process.internal.worker.GradleWorkerMain 'Gradle Test Executor 2' (dns block)
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -Dorg.gradle.internal.worker.tmpdir=/home/REDACTED/work/OpenDataMask/OpenDataMask/backend/build/tmp/test/work -Dorg.gradle.native=false -javaagent:/home/REDACTED/work/OpenDataMask/OpenDataMask/backend/build/tmp/.cache/expanded/zip_0bd0851504e6286cb5fc6f37a81e25cc/jacocoagent.jar=destfile=build/jacoco/test.exec,append=true,inclnolocationclasses=false,dumponexit=true,output=file,jmx=false @/home/REDACTED/.gradle/.tmp/gradle-worker-classpath8772267655896612532txt -Xmx512m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -ea worker.org.gradle.process.internal.worker.GradleWorkerMain 'Gradle Test Executor 4' (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Tightens secret-handling defaults by preventing docker-compose from running with missing secrets and ensuring legacy insecure encryption defaults are rejected at startup.

Changes:

• Update docker-compose.yml to require JWT_SECRET and ENCRYPTION_KEY (fail fast if unset).
• Expand StartupSecurityValidator’s insecure encryption key blocklist to include the prior docker-compose fallback.
• Add a unit test asserting the legacy docker-compose encryption fallback is rejected.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
docker-compose.yml	Switches env var interpolation to required (:?) so compose aborts when secrets are missing.
backend/src/main/kotlin/com/opendatamask/config/StartupSecurityValidator.kt	Adds legacy docker-compose fallback encryption key to insecure-default blocklist.
backend/src/test/kotlin/com/opendatamask/config/StartupSecurityValidatorTest.kt	Adds coverage to ensure the legacy compose fallback encryption key triggers validator failure.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.