Add live-truth architecture reference doc

Replaces the archived master-apps-services.md (Jul 16, 2026) which listed 10+ defunct servers and stale specs (Mattermost, wphost01, standalone hudu, etc.). This is the new single source of truth. Cross-references deployment docs being created in org-audit.
2026-08-09 01:16:24 -04:00
parent 489f690303
commit d4e3777959
2 changed files with 215 additions and 0 deletions
@@ -0,0 +1,85 @@
+#!/bin/bash
+# Pre-commit secret scanner for itpp-infrastructure
+# Scans staged changes for credential patterns before allowing commit.
+# Blocks commits containing API keys, tokens, or passwords.
+
+set -euo pipefail
+
+RED='\033[0;31m'
+NC='\033[0m'
+
+# Patterns that indicate secrets
+PATTERNS=(
+    # API key formats
+    'sk-[a-zA-Z0-9]{32,}'
+    'sk-litellm-[a-zA-Z0-9]{32,}'
+    'Bearer [a-zA-Z0-9_-]{20,}'
+    'x-api-key: [a-zA-Z0-9]{20,}'
+    'api_key.*=.*[a-zA-Z0-9_-]{20,}'
+    'api-key: [a-zA-Z0-9_-]{20,}'
+    # SyncroMSP token patterns
+    'T[0-9a-f]{8}[a-zA-Z0-9_-]{24,}'
+    # Generic secret patterns
+    'passwor[d][[:space:]]*=[[:space:]]*[^[:space:]]{8,}'
+    'secret[[:space:]]*=[[:space:]]*[^[:space:]]{16,}'
+    'token[[:space:]]*=[[:space:]]*[^[:space:]]{16,}'
+    # AWS key patterns
+    'AKIA[0-9A-Z]{16}'
+    'aws_access_key_id[[:space:]]*=[[:space:]]*[A-Z0-9]{16,}'
+    # Private key patterns
+    '-----BEGIN (RSA|OPENSSH|EC) PRIVATE KEY-----'
+    # JWT/stripe patterns
+    'eyJ[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{20,}'
+    'sk_live_[0-9a-zA-Z]{24,}'
+    'pk_live_[0-9a-zA-Z]{24,}'
+)
+
+# Files to skip
+SKIP_GLOB="*.lock|*.png|*.jpg|*.gif|*.svg|*.ico|*.woff*|*.ttf|*.eot|*.min.js|*.min.css|*.map|package-lock.json|yarn.lock|pnpm-lock.yaml|go.sum|Cargo.lock|*.pb.go|*.gen.go|*.generated.*|.gitignore"
+
+FOUND_SECRET=0
+CHANGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
+
+if [ -z "$CHANGED_FILES" ]; then
+    exit 0
+fi
+
+# Create temp file with staged content
+STAGED_DIR=$(mktemp -d)
+trap "rm -rf $STAGED_DIR" EXIT
+
+for file in $CHANGED_FILES; do
+    # Skip binary/lock files
+    if echo "$file" | grep -qE "$SKIP_GLOB"; then
+        continue
+    fi
+
+    # Get staged content
+    mkdir -p "$(dirname "$STAGED_DIR/$file")"
+    git show ":$file" > "$STAGED_DIR/$file" 2>/dev/null || continue
+
+    for pattern in "${PATTERNS[@]}"; do
+        if grep -qE "$pattern" "$STAGED_DIR/$file" 2>/dev/null; then
+            if [ $FOUND_SECRET -eq 0 ]; then
+                echo ""
+                echo -e "${RED}╔══════════════════════════════════════════════╗${NC}"
+                echo -e "${RED}║  SECRET DETECTED — COMMIT BLOCKED           ║${NC}"
+                echo -e "${RED}╚══════════════════════════════════════════════╝${NC}"
+                echo ""
+            fi
+            FOUND_SECRET=1
+            echo -e "${RED}[BLOCKED]${NC} $file — matches pattern: $pattern"
+            echo "  → $(grep -nE "$pattern" "$STAGED_DIR/$file" | head -1 | cut -c1-120)"
+        fi
+    done
+done
+
+if [ $FOUND_SECRET -eq 1 ]; then
+    echo ""
+    echo -e "${RED}Commit aborted. Remove the secrets above and try again.${NC}"
+    echo "If this is a false positive, add the file to SKIP_GLOB in .git/hooks/pre-commit"
+    echo "or use: git commit --no-verify"
+    exit 1
+fi
+
+exit 0