[Chore] Spring Boot 운영 환경 설정 및 Secret 분리 - #75
Conversation
|
Warning Review limit reached
Next review available in: 50 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThe change adds production Spring configuration, externalizes credentials, tightens Docker and Git exclusions, validates conditional Firebase initialization, limits service exposure, updates FCM logging, and makes the analysis consumer configurable. ChangesProduction runtime configuration
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docker-compose.yml (1)
69-73: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRequire production JWT and outbox secrets at Compose parse time.
${JWT_SECRET}and${OUTBOX_ENCRYPTION_KEY_BASE64}become empty values when they are absent. This bypasses the unresolved-placeholder failure inapplication-prod.yml. Require both values with:?so deployment stops before the container starts.Proposed fix
- JWT_SECRET: ${JWT_SECRET} + JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required} @@ - OUTBOX_ENCRYPTION_KEY_BASE64: ${OUTBOX_ENCRYPTION_KEY_BASE64} + OUTBOX_ENCRYPTION_KEY_BASE64: ${OUTBOX_ENCRYPTION_KEY_BASE64:?OUTBOX_ENCRYPTION_KEY_BASE64 is required}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docker-compose.yml` around lines 69 - 73, Update the JWT_SECRET and OUTBOX_ENCRYPTION_KEY_BASE64 entries in the Compose environment configuration to use required-variable syntax with :?, so Compose fails during parsing when either production secret is absent while leaving the expiration defaults unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.dockerignore:
- Around line 11-16: Update the Docker ignore patterns to explicitly exclude the
bare .env file in addition to the existing .env.* pattern, while preserving all
current secret and credential exclusions.
In @.env.example:
- Around line 1-30: Update the .env.example variable names to match
docker-compose.yml, replacing the DB_* connection entries with POSTGRES_USER,
POSTGRES_PASSWORD, and POSTGRES_DB, and replacing FIREBASE_SERVICE_ACCOUNT_PATH
with FIREBASE_SERVICE_ACCOUNT_HOST_PATH. Ensure the resulting template can be
copied directly for the documented Compose startup flow.
In `@docker-compose.yml`:
- Line 60: Update docker-compose.yml lines 60-60 and 112-112 so both Spring and
FastAPI use a pre-percent-encoded RABBITMQ_URL, or configure each client with
separate host, username, and password properties instead of interpolating raw
credentials into the AMQP URI. Apply the same URI-safe configuration
consistently at both sites.
---
Outside diff comments:
In `@docker-compose.yml`:
- Around line 69-73: Update the JWT_SECRET and OUTBOX_ENCRYPTION_KEY_BASE64
entries in the Compose environment configuration to use required-variable syntax
with :?, so Compose fails during parsing when either production secret is absent
while leaving the expiration defaults unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f2f11b9e-0e11-407f-8fd0-67ec8212c423
📒 Files selected for processing (11)
.dockerignore.env.example.env.prod.example.gitignoredocker-compose.ymlsrc/main/java/com/gold/safefam/domain/notification/service/FcmService.javasrc/main/java/com/gold/safefam/global/config/FirebaseConfig.javasrc/main/java/com/gold/safefam/infrastructure/messaging/rabbitmq/consumer/AnalysisResultConsumer.javasrc/main/resources/application-prod.ymlsrc/main/resources/application.ymlsrc/test/resources/application-test.yml
| .env.* | ||
| secrets | ||
| **/firebase-service-account*.json | ||
| **/service-account*.json | ||
| *.pem | ||
| *.key |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Exclude the bare .env file.
.env.* does not match .env. A production .env file can enter the Docker build context and can be copied into an image layer or build cache.
Proposed fix
+.env
.env.*
secrets📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| .env.* | |
| secrets | |
| **/firebase-service-account*.json | |
| **/service-account*.json | |
| *.pem | |
| *.key | |
| .env | |
| .env.* | |
| secrets | |
| **/firebase-service-account*.json | |
| **/service-account*.json | |
| *.pem | |
| *.key |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.dockerignore around lines 11 - 16, Update the Docker ignore patterns to
explicitly exclude the bare .env file in addition to the existing .env.*
pattern, while preserving all current secret and credential exclusions.
# Conflicts: # .gitignore # src/main/java/com/gold/safefam/domain/notification/service/FcmService.java
1 participant
📋 작업 내용
Spring Boot 개발·운영 환경 설정을 분리한다.
운영 전용 prod 프로파일을 구성한다.
운영에 필요한 환경변수 목록과 .env.example을 작성한다.
운영 환경에서 DB 및 RabbitMQ의 개발용 기본 인증정보를 사용하지 않도록 한다.
Firebase 서비스 계정의 운영 주입 방식을 구성한다.
Secret과 Firebase 서비스 계정 파일이 Git 및 Docker 이미지에 포함되지 않도록 .gitignore, .dockerignore를 점검한다.
로그에서 JWT, API Key, 전화번호, 문자 원문 등 Secret과 개인정보가 노출되지 않도록 점검한다.
🧪 테스트 결과
./gradlew clean test bootJar --no-daemon통과bootJar) 빌드 통과docker compose config --quiet --no-interpolate통과git diff --check통과5432, RabbitMQ5672/15672, FastAPI8000포트가 노출되지 않는 것을 확인했습니다..env, Firebase 서비스 계정 JSON, PEM 및 Key 파일이 포함되지 않은 것을 확인했습니다.🔗 관련 이슈
Closes #73
✅ 체크리스트
📌 배포 참고 사항
http://127.0.0.1:8080으로 프록시해야 합니다..env및 Secret은 Git에 커밋하지 않고 AWS Parameter Store에서 런타임에 주입해야 합니다./run/secrets/firebase/service-account.json으로 읽기 전용 마운트해야 합니다.Summary by CodeRabbit