dokploy

6,449 Commits 2 Branches 0 Tags

2 Commits

Author	SHA1	Message	Date
Rafael Dias Zendron GitHub Mauricio Siu	f8a3561f1e	fix(backup): redact S3 credentials from logs and error output (#4648 ) * fix(backup): redact S3 credentials from logs and error output (#4621) S3 backup credentials (access key + secret) were logged in plaintext to Dokploy service stdout via logger.info in getBackupCommand() and console.error in keepLatestNBackups(). Any operator with access to service logs could recover S3 credentials. Added redactRcloneCredentials() pure function that masks --s3-access-key-id and --s3-secret-access-key values with [REDACTED]. Applied to both the structured logger call and the error handler. Closes #4621 * fix(backups): redact sensitive information in error logs during web server backup process Updated error handling in the web server backup function to redact Rclone credentials from error messages before logging and notification. This change enhances security by preventing sensitive data exposure in logs. --------- Co-authored-by: Mauricio Siu <[email protected]>	2026-07-05 16:52:03 -06:00
Rafael Dias ZendronandGitHub	ec9dd28924	fix(registry): preserve username case for ECR compatibility (#4632 ) (#4647 ) Remove .toLowerCase() transform from registryUsernameSchema. AWS ECR requires the username to be exactly 'AWS' (uppercase) for authentication. Docker Hub usernames are case-insensitive for login, so preserving case is safe for all providers. Closes #4632	2026-06-30 16:07:15 -06:00

Author

SHA1

Message

Date

f8a3561f1e

fix(backup): redact S3 credentials from logs and error output (#4648 )

* fix(backup): redact S3 credentials from logs and error output (#4621)

S3 backup credentials (access key + secret) were logged in plaintext
to Dokploy service stdout via logger.info in getBackupCommand() and
console.error in keepLatestNBackups(). Any operator with access to
service logs could recover S3 credentials.

Added redactRcloneCredentials() pure function that masks
--s3-access-key-id and --s3-secret-access-key values with [REDACTED].
Applied to both the structured logger call and the error handler.

Closes #4621

* fix(backups): redact sensitive information in error logs during web server backup process

Updated error handling in the web server backup function to redact Rclone credentials from error messages before logging and notification. This change enhances security by preventing sensitive data exposure in logs.

---------

Co-authored-by: Mauricio Siu <[email protected]>

2026-07-05 16:52:03 -06:00

Rafael Dias ZendronandGitHub

ec9dd28924

fix(registry): preserve username case for ECR compatibility (#4632 ) (#4647 )

Remove .toLowerCase() transform from registryUsernameSchema.
AWS ECR requires the username to be exactly 'AWS' (uppercase) for
authentication. Docker Hub usernames are case-insensitive for login,
so preserving case is safe for all providers.

Closes #4632

2026-06-30 16:07:15 -06:00