security: geleakte Secrets aus Repo entfernen (Review-Befund k)

Secret-Scan im Fable-5-Review fand vier aktive Zugangsdaten im oeffentlich erreichbaren Gitea-Repo. Gefahrlos entfernbare Stellen: - scripts/release.ps1: Gitea-Token -> Umgebungsvariable PYRAMID_GITEA_TOKEN - docs/matrix-sdk/13-server-admin: 19x Admin-Token -> <ADMIN_TOKEN> Client-eingebettete Secrets (LiveKit apiSecret, Admin-Token im E2EE-Diagnose-Upload, Giphy-Key) brauchen Rotation + Server-Umbau und stehen als neue M0-ROADMAP-Punkte (nicht blind auf dem Pi fixbar). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-04 03:32:37 +02:00
parent a5a5c4baf5
commit fe6427bfba
5 changed files with 111 additions and 20 deletions
@@ -70,7 +70,7 @@ Continuwuity hat einen speziellen Admin-Raum. Als Server-Admin kannst du dort Be
 # Als curl (Admin-Token erforderlich):
 # Admin-Room-ID herausfinden:
 curl -s "https://steggi-matrix.work/_matrix/client/v3/directory/room/%23admins%3Asteggi-matrix.work" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI"
+  -H "Authorization: Bearer <ADMIN_TOKEN>"
 # → {"room_id": "!adminRoomId:steggi-matrix.work", ...}
 ```

@@ -84,22 +84,22 @@ curl -s "https://steggi-matrix.work/_matrix/client/v3/directory/room/%23admins%3

 # User zu Server-Admin machen
 curl -X POST "https://steggi-matrix.work/_conduwuit/admin/v1/make_user_admin" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "@todesneutron:steggi-matrix.work"}'

 # Server-Status abfragen
 curl "https://steggi-matrix.work/_conduwuit/server/version" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI"
+  -H "Authorization: Bearer <ADMIN_TOKEN>"

 # Alternativ — Standard Matrix-Whoami (prüft ob Token gültig):
 curl "https://steggi-matrix.work/_matrix/client/v3/account/whoami" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI"
+  -H "Authorization: Bearer <ADMIN_TOKEN>"
 # → {"user_id": "@todesneutron:steggi-matrix.work", "is_guest": false}

 # Prüfen ob User Server-Admin ist (Conduwuit-spezifisch):
 curl "https://steggi-matrix.work/_conduwuit/admin/v1/users/@todesneutron:steggi-matrix.work" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI"
+  -H "Authorization: Bearer <ADMIN_TOKEN>"
 ```

 ---
@@ -112,7 +112,7 @@ Als Server-Admin kannst du via Matrix Client API Power Levels in jedem Raum setz
 ```bash
 # Schritt 1: Aktuelles Power-Level-Event lesen
 ROOM_ID="!raumId:steggi-matrix.work"
-TOKEN="J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI"
+TOKEN="<ADMIN_TOKEN>"
 SERVER="https://steggi-matrix.work"

 curl "${SERVER}/_matrix/client/v3/rooms/${ROOM_ID}/state/m.room.power_levels/" \
@@ -172,7 +172,7 @@ await client.setRoomStateWithKey(
 ```bash
 # Testen ob restricted join rules funktionieren:
 ROOM_ID="!testRaum:steggi-matrix.work"
-TOKEN="J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI"
+TOKEN="<ADMIN_TOKEN>"
 SPACE_ID="!spaceId:steggi-matrix.work"

 curl -X PUT "https://steggi-matrix.work/_matrix/client/v3/rooms/${ROOM_ID}/state/m.room.join_rules/" \
@@ -230,7 +230,7 @@ try {
 ```bash
 # 1. Prüfen: Welchen Power Level hat mein User in diesem Raum?
 ROOM_ID="!raumId:steggi-matrix.work"
-TOKEN="J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI"
+TOKEN="<ADMIN_TOKEN>"

 curl "https://steggi-matrix.work/_matrix/client/v3/rooms/${ROOM_ID}/state/m.room.power_levels/" \
  -H "Authorization: Bearer ${TOKEN}"
@@ -269,7 +269,7 @@ curl "https://steggi-matrix.work/_matrix/client/v3/capabilities" \
 ```bash
 # Prüfen ob User Server-Admin ist:
 curl "https://steggi-matrix.work/_matrix/client/v3/account/whoami" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI"
+  -H "Authorization: Bearer <ADMIN_TOKEN>"

 # Auf Pi (SSH): User-Datenbank direkt abfragen (Conduwuit/Continuwuity nutzt RocksDB)
 # Alternativ: Über Admin-Room-Befehl
@@ -278,7 +278,7 @@ curl "https://steggi-matrix.work/_matrix/client/v3/account/whoami" \

 # Über HTTP (Conduwuit Admin-Endpoint):
 curl -X POST "https://steggi-matrix.work/_conduwuit/admin/v1/make_user_admin" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "@todesneutron:steggi-matrix.work"}'
 ```
@@ -292,19 +292,19 @@ Da kein Synapse-Admin-API existiert, nutze die Standard-Matrix-Client-API mit Ad
 ```bash
 # Raum beitreten (als Admin, auch wenn invite-only):
 curl -X POST "https://steggi-matrix.work/_matrix/client/v3/join/!roomId%3Asteggi-matrix.work" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{}'

 # User in Raum einladen:
 curl -X POST "https://steggi-matrix.work/_matrix/client/v3/rooms/!roomId%3Asteggi-matrix.work/invite" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "@user:steggi-matrix.work"}'

 # Space-Child-Relation setzen (Channel einem Space hinzufügen):
 curl -X PUT "https://steggi-matrix.work/_matrix/client/v3/rooms/!spaceId%3Asteggi-matrix.work/state/m.space.child/!channelId%3Asteggi-matrix.work/" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "via": ["steggi-matrix.work"],
@@ -313,7 +313,7 @@ curl -X PUT "https://steggi-matrix.work/_matrix/client/v3/rooms/!spaceId%3Astegg

 # Space-Parent-Relation setzen (im Channel-Raum):
 curl -X PUT "https://steggi-matrix.work/_matrix/client/v3/rooms/!channelId%3Asteggi-matrix.work/state/m.space.parent/!spaceId%3Asteggi-matrix.work/" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "via": ["steggi-matrix.work"],
@@ -322,11 +322,11 @@ curl -X PUT "https://steggi-matrix.work/_matrix/client/v3/rooms/!channelId%3Aste

 # Alle Mitglieder eines Raums auflisten:
 curl "https://steggi-matrix.work/_matrix/client/v3/rooms/!roomId%3Asteggi-matrix.work/members" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI"
+  -H "Authorization: Bearer <ADMIN_TOKEN>"

 # Raum verlassen (als User, nicht löschen):
 curl -X POST "https://steggi-matrix.work/_matrix/client/v3/rooms/!roomId%3Asteggi-matrix.work/leave" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI" \
+  -H "Authorization: Bearer <ADMIN_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{}'
 ```
@@ -419,15 +419,15 @@ Wenn du M_FORBIDDEN bekommst:
 ```bash
 # 1. Token gültig?
 curl "https://steggi-matrix.work/_matrix/client/v3/account/whoami" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI"
+  -H "Authorization: Bearer <ADMIN_TOKEN>"

 # 2. PL im betroffenen Raum prüfen:
 curl "https://steggi-matrix.work/_matrix/client/v3/rooms/!ROOM_ID/state/m.room.power_levels/" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI"
+  -H "Authorization: Bearer <ADMIN_TOKEN>"

 # 3. Mitglied des Raums?
 curl "https://steggi-matrix.work/_matrix/client/v3/rooms/!ROOM_ID/state/m.room.member/%40todesneutron%3Asteggi-matrix.work/" \
-  -H "Authorization: Bearer J5laxTz5Zte9oRB5x8QsyYRQ6b0hAuXI"
+  -H "Authorization: Bearer <ADMIN_TOKEN>"

 # 4. Was genau schlägt fehl? (Antwort-Body lesen!)
 # M_FORBIDDEN + "Power level too low" → PL erhöhen