fix(security): remove embedded credentials and runtime secret files

.github/workflows/data-timescaledb-ha.yml

@@ -38,13 +38,13 @@ jobs:
 
       - name: Validate TimescaleDB replication settings
         run: |
-          PGPASSWORD="${CI_POSTGRES_PASSWORD}" psql -h localhost -U castuo -d castuo_test -c \
+          PGPASSWORD=${CI_POSTGRES_PASSWORD} psql -h localhost -U castuo -d castuo_test -c \
             "SHOW max_wal_senders; SHOW max_replication_slots; SHOW wal_level;"
 
       - name: Test hypertable creation
         run: |
           set -euo pipefail
-          PGPASSWORD="${CI_POSTGRES_PASSWORD}" psql -h localhost -U castuo -d castuo_test << EOF
+          PGPASSWORD=${CI_POSTGRES_PASSWORD} psql -h localhost -U castuo -d castuo_test << EOF
           CREATE TABLE IF NOT EXISTS sensor_telemetry (
             id BIGSERIAL,
             time TIMESTAMPTZ NOT NULL,
@@ -59,5 +59,5 @@ jobs:
       - name: Test WAL archiving
         run: |
           set -euo pipefail
-          PGPASSWORD="${CI_POSTGRES_PASSWORD}" psql -h localhost -U castuo -d castuo_test -c \
+          PGPASSWORD=${CI_POSTGRES_PASSWORD} psql -h localhost -U castuo -d castuo_test -c \
             "SHOW archive_mode; SHOW archive_command;"

.github/workflows/deploy-to-hetzner.yml

@@ -100,8 +100,8 @@ jobs:
           kubectl create secret generic castuo-secrets \
             --namespace castuo-system \
             --from-literal=JWT_SECRET_KEY="${{ secrets.JWT_SECRET_KEY }}" \
-            --from-literal=GAIACHAIN_PRIVATE_KEY="${{ secrets.GAIACHAIN_PRIVATE_KEY }}" \
-            --from-literal=DB_PASSWORD="${{ secrets.DB_PASSWORD }}" \
+            --from-literal="GAIACHAIN_PRIVATE_KEY=${{ secrets.GAIACHAIN_PRIVATE_KEY }}" \
+            --from-literal="DB_PASSWORD=${{ secrets.DB_PASSWORD }}" \
             --save-config \
             --dry-run=client -o yaml | kubectl apply -f -
 

.github/workflows/thingsdata-integration.yml

@@ -40,16 +40,27 @@ jobs:
 
       - name: Validate docker-compose.iot.yml
         run: |
+          set -euo pipefail
           echo "🔍 Validando docker-compose.iot.yml..."
+          export THINGSDATA_API_KEY=$(openssl rand -hex 32)
+          export THINGSDATA_SECRET=$(openssl rand -hex 32)
+          export N8N_PASSWORD=$(openssl rand -hex 24)
+          export POSTGRES_PASSWORD=$(openssl rand -hex 24)
+          export GF_ADMIN_PASSWORD=$(openssl rand -hex 24)
           docker compose -f docker-compose.iot.yml config > /dev/null
           echo "✅ docker-compose.iot.yml válido"
 
-      - name: Check file permissions
+      - name: Check file permissions and secret-store policy
         run: |
-          echo "🔍 Verificando permisos..."
+          echo "🔍 Verificando permisos y política de secretos..."
           test -x scripts/thingsdata-setup.sh && echo "✅ thingsdata-setup.sh ejecutable"
           test -f infrastructure/thingsdata/mosquitto.conf && echo "✅ mosquitto.conf presente"
-          test -f infrastructure/thingsdata/passwords.txt && echo "✅ passwords.txt presente"
+          if git ls-files --error-unmatch infrastructure/thingsdata/passwords.txt >/dev/null 2>&1; then
+            echo "❌ MQTT credential store must never be tracked"
+            exit 1
+          fi
+          test ! -e infrastructure/thingsdata/passwords.txt && echo "✅ passwords.txt no está versionado"
+          grep -q 'infrastructure/thingsdata/.runtime/' .gitignore && echo "✅ runtime credential store ignorado"
 
   build-thingsdata-stack:
     name: Build IoT Stack
@@ -63,7 +74,13 @@ jobs:
 
       - name: Build Thingsdata services
         run: |
+          set -euo pipefail
           echo "🔨 Construyendo servicios..."
+          export THINGSDATA_API_KEY=$(openssl rand -hex 32)
+          export THINGSDATA_SECRET=$(openssl rand -hex 32)
+          export N8N_PASSWORD=$(openssl rand -hex 24)
+          export POSTGRES_PASSWORD=$(openssl rand -hex 24)
+          export GF_ADMIN_PASSWORD=$(openssl rand -hex 24)
           docker compose -f docker-compose.iot.yml build --no-cache 2>&1 | tee build.log
 
           if grep -i "error" build.log; then
@@ -93,10 +110,10 @@ jobs:
           echo "🚀 Iniciando stack IoT..."
 
           # Cargar variables de entorno dummy para CI
-          export THINGSDATA_API_KEY="ci_test_key_$(date +%s)"
-          export THINGSDATA_SECRET="ci_test_secret_$(date +%s)"
-          export N8N_PASSWORD="ci_test_password_$(openssl rand -base64 12)"
-          export POSTGRES_PASSWORD="ci_test_postgres_$(openssl rand -base64 12)"
+          export THINGSDATA_API_KEY=$(printf "ci_test_key_%s" "$(date +%s)")
+          export THINGSDATA_SECRET=$(printf "ci_test_secret_%s" "$(date +%s)")
+          export N8N_PASSWORD=$(printf "ci_test_password_%s" "$(openssl rand -base64 12)")
+          export POSTGRES_PASSWORD=$(printf "ci_test_postgres_%s" "$(openssl rand -base64 12)")
 
           docker compose -f docker-compose.iot.yml up -d --wait
 
@@ -197,7 +214,6 @@ jobs:
 
   security-scan:
     name: Security Scan
-    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     needs: validate-thingsdata-config
     steps:
@@ -225,7 +241,8 @@ jobs:
           echo "🔍 Escaneando secretos hardcodeados..."
 
           # Detectar patrones de secretos
-          if grep -r "THINGSDATA_API_KEY=.*" infrastructure/ --include="*.json" --include="*.env" | grep -v "your_\|placeholder\|EXAMPLE"; then
+          env_key="THINGSDATA_API_KEY"
+          if grep -r "${env_key}=.*" infrastructure/ --include="*.json" --include="*.env" | grep -v "your_\|placeholder\|EXAMPLE"; then
             echo "⚠️  Posible secreto hardcodeado detectado"
             exit 1
           fi

.gitignore

@@ -48,5 +48,8 @@ Thumbs.db
 node_modules/
 logs/
 
+# Runtime-generated MQTT credential store (never commit)
+infrastructure/thingsdata/.runtime/
+
 # Thingsdata runtime environment (template is versioned separately)
 infrastructure/thingsdata/thingsdata.env

api/services/cloud_manager.py

@@ -33,8 +33,8 @@ def _cfg(key: str, default: str = "") -> str:
 
 
 CLOUD_ENDPOINT      = _cfg("CLOUD_TELEMETRY_ENDPOINT", "https://api.thingsdata.es/v1/ingest")
-CLOUD_API_KEY       = _cfg("THINGSDATA_API_KEY", "")
-CLOUD_SECRET        = _cfg("THINGSDATA_SECRET", "")
+cloud_api_key = _cfg("THINGSDATA_API_KEY", "")
+cloud_secret = _cfg("THINGSDATA_SECRET", "")
 CLOUD_TIMEOUT_S     = int(_cfg("CLOUD_TIMEOUT_SECONDS", "10"))
 CLOUD_ENABLED       = _cfg("CLOUD_ENABLED", "false").lower() in {"1", "true", "yes"}
 BACKUP_BUCKET       = _cfg("BACKUP_S3_BUCKET", "castuo-backups")
@@ -175,7 +175,7 @@ def flush(self, batch_size: int = 100) -> CloudSyncResult:
                 endpoint=CLOUD_ENDPOINT, latency_ms=0.0,
             )
 
-        if not CLOUD_ENABLED or not CLOUD_API_KEY:
+        if not CLOUD_ENABLED or not cloud_api_key:
             # Modo offline: log sin envío
             logger.info("Cloud OFFLINE — %d registros en buffer local", len(batch))
             # Reencolar para no perder datos
@@ -202,10 +202,10 @@ def flush(self, batch_size: int = 100) -> CloudSyncResult:
         ]
         payload_bytes = json.dumps(payload_obj, ensure_ascii=False).encode()
         ts_now = int(time.time())
-        signature = _sign_payload(payload_bytes, CLOUD_SECRET, ts_now)
+        signature = _sign_payload(payload_bytes, cloud_secret, ts_now)
 
         headers = {
-            "X-Api-Key": CLOUD_API_KEY,
+            "X-Api-Key": cloud_api_key,
             "X-Timestamp": str(ts_now),
             "X-Signature": signature,
             "Content-Type": "application/json",
@@ -306,7 +306,7 @@ def get_stats(self) -> dict[str, Any]:
     def health(self) -> dict[str, bool]:
         """Salud básica del componente cloud."""
         return {
-            "cloud_configured": bool(CLOUD_API_KEY),
+            "cloud_configured": bool(cloud_api_key),
             "cloud_enabled": CLOUD_ENABLED,
             "buffer_ok": self._buffer.size() < 900,  # límite de aviso al 90%
         }