Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 19 additions & 19 deletions pkg/moni/constants.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,11 @@ import "time"

// Container names
const (
PostgresContainer = "bionicgpt-postgres"
LiteLLMContainer = "bionicgpt-litellm"
LiteLLMDBContainer = "bionicgpt-litellm-db"
LangfuseDBContainer = "bionicgpt-langfuse-db"
AppContainer = "bionicgpt-app"
PostgresContainer = "bionicgpt-postgres"
LiteLLMContainer = "bionicgpt-litellm"
LiteLLMDBContainer = "bionicgpt-litellm-db"
LangfuseDBContainer = "bionicgpt-langfuse-db"
AppContainer = "bionicgpt-app"
)

// Service URLs
Expand Down Expand Up @@ -50,12 +50,12 @@ const (

// SSL Certificate ownership (Alpine PostgreSQL containers)
const (
CertOwnerUID = 0 // root
CertOwnerGID = 70 // postgres group in Alpine
CertKeyPerms = 0640
CertCrtPerms = 0644
StandardUID = 999 // Standard PostgreSQL UID
TempKeyPerms = 0600
CertOwnerUID = 0 // root
CertOwnerGID = 70 // postgres group in Alpine
CertKeyPerms = 0640
CertCrtPerms = 0644
StandardUID = 999 // Standard PostgreSQL UID
TempKeyPerms = 0600
)

// Certificate strategies
Expand All @@ -70,14 +70,14 @@ const (
// max completion tokens. This prevents API errors when BionicGPT reads this
// value and sends it as max_tokens in requests.
const (
ModelContextSize = 16384
EmbeddingsContextSize = 8192
ModelTPMLimit = 50000
ModelRPMLimit = 1000
ModelFallbackTPMLimit = 30000
ModelFallbackRPMLimit = 500
EmbeddingsTPMLimit = 10000
EmbeddingsRPMLimit = 10000
ModelContextSize = 16384
EmbeddingsContextSize = 8192
ModelTPMLimit = 50000
ModelRPMLimit = 1000
ModelFallbackTPMLimit = 30000
ModelFallbackRPMLimit = 500
EmbeddingsTPMLimit = 10000
EmbeddingsRPMLimit = 10000
)

// RLS table counts
Expand Down
4 changes: 2 additions & 2 deletions pkg/moni/database.go
Original file line number Diff line number Diff line change
Expand Up @@ -377,8 +377,8 @@ WHERE schemaname = 'public' AND rowsecurity = true;
" • bionic_application user does not exist\n"+
"Fix: Ensure PostgreSQL is running and bionic_application user exists", err)
} else if isSuperuser == "t" || isSuperuser == "true" {
return fmt.Errorf("CRITICAL SECURITY FAILURE: bionic_application is a superuser and will BYPASS all RLS policies\n"+
"RLS is completely ineffective when the user is a superuser.\n"+
return fmt.Errorf("CRITICAL SECURITY FAILURE: bionic_application is a superuser and will BYPASS all RLS policies\n" +
"RLS is completely ineffective when the user is a superuser.\n" +
"Fix: Revoke superuser: ALTER USER bionic_application NOSUPERUSER;")
} else {
logger.Info("Verified: bionic_application is NOT a superuser (RLS will work correctly)")
Expand Down
54 changes: 27 additions & 27 deletions pkg/moni/types.go
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,11 @@ type WorkerConfig struct {
SkipVerification bool

// Validation only
ValidateCertsOnly bool
FixCertsOnly bool
VerifyDBOnly bool
VerifyRLSOnly bool
VerifyCSPOnly bool
ValidateCertsOnly bool
FixCertsOnly bool
VerifyDBOnly bool
VerifyRLSOnly bool
VerifyCSPOnly bool
VerifySecurityOnly bool

// Cleanup
Expand Down Expand Up @@ -61,13 +61,13 @@ type HealthCheckResult struct {

// RLSVerificationResult contains RLS verification results
type RLSVerificationResult struct {
RLSEnabled bool
TablesWithRLS []string
TablesWithoutRLS []string
PoliciesFound []RLSPolicy
CriticalTablesProtected bool
Warnings []string
Errors []string
RLSEnabled bool
TablesWithRLS []string
TablesWithoutRLS []string
PoliciesFound []RLSPolicy
CriticalTablesProtected bool
Warnings []string
Errors []string
}

// RLSPolicy represents a Row Level Security policy
Expand All @@ -91,12 +91,12 @@ type CSPVerificationResult struct {

// DBVerificationResult contains database verification results
type DBVerificationResult struct {
ModelCount int
MoniExists bool
Models []DBModel
Prompts []DBPrompt
Errors []string
Warnings []string
ModelCount int
MoniExists bool
Models []DBModel
Prompts []DBPrompt
Errors []string
Warnings []string
}

// DBModel represents a database model record
Expand Down Expand Up @@ -129,13 +129,13 @@ type EnvCheckResult struct {

// SetupResult contains the overall setup result
type SetupResult struct {
Success bool
Phases []SetupPhase
HealthCheck *HealthCheckResult
RLSVerification *RLSVerificationResult
CSPVerification *CSPVerificationResult
DBVerification *DBVerificationResult
StartTime time.Time
EndTime time.Time
CriticalIssues []string
Success bool
Phases []SetupPhase
HealthCheck *HealthCheckResult
RLSVerification *RLSVerificationResult
CSPVerification *CSPVerificationResult
DBVerification *DBVerificationResult
StartTime time.Time
EndTime time.Time
CriticalIssues []string
}
22 changes: 11 additions & 11 deletions pkg/moni/verification.go
Original file line number Diff line number Diff line change
Expand Up @@ -382,22 +382,22 @@ func VerifyContentSecurityPolicy(rc *eos_io.RuntimeContext) (*CSPVerificationRes

// Expected secure CSP directives
recommendedDirectives := map[string]string{
"default-src": "'self'",
"script-src": "'self'",
"style-src": "'self' 'unsafe-inline'",
"img-src": "'self' data:",
"font-src": "'self'",
"connect-src": "'self'",
"default-src": "'self'",
"script-src": "'self'",
"style-src": "'self' 'unsafe-inline'",
"img-src": "'self' data:",
"font-src": "'self'",
"connect-src": "'self'",
"frame-ancestors": "'none'",
"base-uri": "'self'",
"form-action": "'self'",
"base-uri": "'self'",
"form-action": "'self'",
}

// Dangerous patterns
dangerousPatterns := map[string]string{
"'unsafe-eval'": "Allows eval() - major XSS risk",
"* 'unsafe-inline' 'unsafe-eval'": "Extremely permissive - defeats CSP purpose",
"*": "Wildcard allows any source - too permissive",
"'unsafe-eval'": "Allows eval() - major XSS risk",
"* 'unsafe-inline' 'unsafe-eval'": "Extremely permissive - defeats CSP purpose",
"*": "Wildcard allows any source - too permissive",
}

// Step 1: Check if app is responding
Expand Down
10 changes: 5 additions & 5 deletions pkg/moni/worker.go
Original file line number Diff line number Diff line change
Expand Up @@ -290,11 +290,11 @@ func runPhase(rc *eos_io.RuntimeContext, number int, name string, fn func() erro
logger.Info("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━")

phase := SetupPhase{
Number: number,
Name: name,
StartTime: time.Now(),
Errors: []string{},
Warnings: []string{},
Number: number,
Name: name,
StartTime: time.Now(),
Errors: []string{},
Warnings: []string{},
}

err := fn()
Expand Down
Loading