# GitHub Secrets Setup for CI/CD Deployment

## 🔐 Required GitHub Secrets

The following secrets must be configured in your GitHub repository settings:
**Settings → Secrets and variables → Actions → New repository secret**

### Required Secrets

| Secret Name | Value | Description |
|------------|-------|-------------|
| `SSH_HOST` | `195.88.211.210` | Deployment server IP address |
| `SSH_USERNAME` | `cbtappsc` | SSH username for server access |
| `SSH_PASSWORD` | `<new_password>` | SSH password (⚠️ **ROTATE IMMEDIATELY**) |
| `SSH_PORT` | `6123` | SSH port number |

## ⚠️ CRITICAL SECURITY ACTIONS REQUIRED

### 1. IMMEDIATE: Rotate Server Password (Within 2 Hours)

The password `D9jQ_GQp*Wh8` has been **EXPOSED** in the git repository and must be changed immediately.

**Steps:**
1. SSH into the server with current credentials
2. Change the password: `passwd`
3. Update the `SSH_PASSWORD` secret in GitHub with the new password
4. Test the CI/CD workflow to ensure it works

### 2. Audit Server Access Logs

Check for any suspicious activity on the deployment server:

```bash
# Check recent SSH logins
sudo last | head -50

# Check authentication logs
sudo grep "sshd" /var/log/auth.log | tail -100

# Look for failed login attempts
sudo grep "Failed password" /var/log/auth.log | tail -50
```

### 3. Long-term Security Improvements (Within 24 Hours)

#### Option A: SSH Key Authentication (Recommended)

Instead of using password authentication, use SSH keys:

1. **Generate SSH key pair:**
   ```bash
   ssh-keygen -t ed25519 -C "github-actions" -f ~/.ssh/github_actions
   ```

2. **Add public key to server:**
   ```bash
   cat ~/.ssh/github_actions.pub | ssh cbtappsc@195.88.211.210 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
   ```

3. **Update GitHub Secrets:**
   - Remove: `SSH_PASSWORD`
   - Add: `SSH_KEY` (paste the entire private key file content)

4. **Update `.github/workflows/ci.yml`:**
   ```yaml
   - name: 🚀 SSH deploy to server
     uses: appleboy/ssh-action@v1.0.3
     with:
       host: ${{ secrets.SSH_HOST }}
       username: ${{ secrets.SSH_USERNAME }}
       key: ${{ secrets.SSH_KEY }}
       port: ${{ secrets.SSH_PORT }}
   ```

5. **Disable password authentication on server:**
   ```bash
   sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
   sudo systemctl restart sshd
   ```

#### Option B: GitHub Actions OIDC (Enterprise)

For production deployments, consider using GitHub Actions OIDC:
- https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-aws

### 4. Prevent Future Secrets Leaks

Add pre-commit hooks to detect secrets:

```bash
# Install git-secrets
brew install git-secrets  # macOS
# or
sudo apt-get install git-secrets  # Ubuntu

# Configure for your repository
git secrets --install
git secrets --register-aws
git secrets --add 'password\s*[:=]\s*["\']?[^\s"\']+'
git secrets --add 'api[_-]?key\s*[:=]\s*["\']?[^\s"\']+'
```

## ✅ Verification Checklist

After completing the setup:

- [ ] All 4 GitHub Secrets are configured in repository settings
- [ ] Server password has been rotated
- [ ] CI/CD workflow runs successfully with secrets
- [ ] No hardcoded credentials remain in the repository
- [ ] Server access logs have been audited
- [ ] SSH key authentication or OIDC is implemented (long-term)

## 📝 Notes

- **Never commit secrets to the repository**
- **Rotate credentials immediately if exposed**
- **Use GitHub Secrets for all sensitive data**
- **Enable branch protection rules** to require PR reviews
- **Enable Dependabot alerts** for security vulnerabilities

---

**Created:** 2026-04-08
**Related Issue:** [ENI-64](/ENI/issues/ENI-64) - CRITICAL: Fix Hardcoded CI/CD Credentials