Add monitoring PF CI hygiene guard

.gitea/scripts/hygiene-check.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+fail=0
+
+while IFS= read -r -d '' path; do
+  base="$(basename "$path")"
+  case "$base" in
+    .DS_Store|.env)
+      echo "::error file=$path::tracked local-only file is forbidden"
+      fail=1
+      ;;
+  esac
+
+  case "$path" in
+    *node_modules/*|node_modules/*)
+      echo "::error file=$path::tracked node_modules content is forbidden"
+      fail=1
+      ;;
+    *.tmp|*.temp|*.bak|*.orig|*.rej|*.zip|*.tar|*.tar.gz|*.tgz|*.rar|*.7z)
+      echo "::error file=$path::tracked temporary/archive artifact is forbidden"
+      fail=1
+      ;;
+  esac
+
+  if [ -f "$path" ]; then
+    size="$(wc -c < "$path" | tr -d ' ')"
+    if [ "${size:-0}" -gt 52428800 ]; then
+      echo "::error file=$path::tracked file is larger than 50 MiB"
+      fail=1
+    fi
+  fi
+done < <(git ls-files -z)
+
+exit "$fail"

.gitea/workflows/ci.yml

@@ -5,8 +5,15 @@ on:
   pull_request:
 
 jobs:
+  hygiene:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: bash .gitea/scripts/hygiene-check.sh
+
   go:
     runs-on: ubuntu-latest
+    needs: hygiene
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -22,6 +29,7 @@ jobs:
 
   python:
     runs-on: ubuntu-latest
+    needs: hygiene
     steps:
       - uses: actions/checkout@v4
       - run: python3 -m compileall app

internal/pf/config.go

@@ -15,6 +15,7 @@ type Config struct {
 	ScrapeIntervalHours int
 	TGBotToken          string
 	TGBotUsername       string
+	InternalAPIKey      string
 	WorkerPython        string
 	WorkerModule        string
 }
@@ -28,6 +29,7 @@ func LoadConfig() Config {
 		ScrapeIntervalHours: max(1, envInt("SCRAPE_INTERVAL_HOURS", 4)),
 		TGBotToken:          env("TG_BOT_TOKEN", ""),
 		TGBotUsername:       strings.TrimPrefix(env("TG_BOT_USERNAME", ""), "@"),
+		InternalAPIKey:      env("INTERNAL_API_KEY", env("PORTAL_INTERNAL_API_KEY", "")),
 		WorkerPython:        env("WORKER_PYTHON", "python"),
 		WorkerModule:        env("WORKER_MODULE", "app.worker"),
 	}

internal/pf/http.go

@@ -29,6 +29,8 @@ func (s Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, http.StatusOK, map[string]string{"service": "monitoring-pf", "ui": "portal", "api": "go"})
 	case !strings.HasPrefix(path, "/api/v1"):
 		writeError(w, http.StatusNotFound, "not found")
+	case !s.checkInternalAuth(w, r):
+		return
 	case path == "/api/v1/access/me" && r.Method == http.MethodGet:
 		s.accessMe(w, r)
 	case path == "/api/v1/summary" && r.Method == http.MethodGet:
@@ -50,6 +52,18 @@ func (s Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+func (s Server) checkInternalAuth(w http.ResponseWriter, r *http.Request) bool {
+	want := strings.TrimSpace(s.App.Cfg.InternalAPIKey)
+	if want == "" {
+		return true
+	}
+	if r.Header.Get("X-Internal-Key") != want {
+		writeError(w, http.StatusUnauthorized, "unauthorized")
+		return false
+	}
+	return true
+}
+
 func (s Server) apiPath(path string) string {
 	base := s.App.Cfg.PublicBasePath
 	if base != "" && path == base {

k8s/secrets.yaml

@@ -5,5 +5,6 @@ metadata:
   namespace: monitoring-pf
 type: Opaque
 stringData:
+  INTERNAL_API_KEY: "36fe89ed40c01fdc54d3cf4e3fcacc8751dc456a4a1acd394e9fed48257c5734"
   TG_BOT_TOKEN: "8942895371:AAGCWTr8g0FeqdM3QWmbV_3PxoSb5c_urf0"
   ADMIN_CHAT_ID: ""