feat: security-harden the RPi camera plugin and reorganize into delivery/streaming/observability

.env.example

@@ -16,9 +16,10 @@
 #
 # APP_BUILD_TARGET=runtime-standalone
 # COMPOSE_PROFILES=standalone
+# APP_ENV=development                  # permits local RustFS over HTTP
 #
 # IMAGE_SINK=s3
-# S3_ENDPOINT_URL=http://host.docker.internal:9000
+# S3_ENDPOINT_URL=http://127.0.0.1:9000
 # S3_BUCKET=rpi-cam
 # S3_ACCESS_KEY_ID=rustfsadmin
 # S3_SECRET_ACCESS_KEY=change-me-to-a-strong-password
@@ -27,17 +28,20 @@
 #
 # RUSTFS_ACCESS_KEY=rustfsadmin
 # RUSTFS_SECRET_KEY=change-me-to-a-strong-password   # required — RustFS won't start without it
+# RUSTFS_API_BIND=127.0.0.1       # loopback-only by default; set a LAN IP only when intentionally exposing RustFS
+# RUSTFS_CONSOLE_BIND=127.0.0.1   # loopback-only by default; set a LAN IP only when intentionally exposing RustFS
 
 # ─── Observability (optional) ────────────────────────────────────────────────
 # Ships structured logs (and optionally metrics) to a central Loki/Prometheus.
 # Combine with standalone: COMPOSE_PROFILES=standalone,observability-ship
 #
 # COMPOSE_PROFILES=observability-ship
-# LOKI_PUSH_URL=http://your-observability-host:3100/loki/api/v1/push
-# PROMETHEUS_REMOTE_WRITE_URL=http://your-observability-host:9090/api/v1/write
+# LOKI_PUSH_URL=https://your-observability-host/loki/api/v1/push
+# PROMETHEUS_REMOTE_WRITE_URL=https://your-observability-host/api/v1/write
+# PROMETHEUS_SCRAPE_API_KEY=CHANGE_ME     # must also be in AUTHORIZED_API_KEYS
 # OBSERVABILITY_INSTANCE=pi-01
 # OTEL_ENABLED=true
-# OTEL_EXPORTER_OTLP_ENDPOINT=http://your-observability-host:4318/v1/traces
+# OTEL_EXPORTER_OTLP_ENDPOINT=https://your-observability-host:4318/v1/traces
 # OTEL_SERVICE_NAME=relab-rpi-cam-plugin
 
 # ─── Direct connection (local mode) ──────────────────────────────────────────
@@ -52,7 +56,8 @@
 # LOCAL_ALLOWED_ORIGINS='["http://192.168.1.42"]'  # extra CORS origins (rarely needed)
 
 # ─── Advanced ────────────────────────────────────────────────────────────────
-# AUTHORIZED_API_KEYS='["CHANGE_ME"]'   # X-Api-Key auth; not needed for relay
+# AUTHORIZED_API_KEYS='["CHANGE_ME"]'   # X-Api-Key auth; needed for protected /metrics scraping
+# APP_ENV=production                    # default; requires HTTPS for remote S3/OTLP endpoints
 # CAMERA_DEVICE_NUM=0                   # override if using a non-default camera
 # BASE_URL=http://127.0.0.1:8018        # override if the Pi is at a different address
 # ALLOWED_CORS_ORIGINS='["http://127.0.0.1:8000"]'

renovate.json → .github/renovate.json

@@ -10,46 +10,28 @@
   "semanticCommits": "enabled",
   "semanticCommitType": "chore",
   "semanticCommitScope": "deps",
-  "platformAutomerge": true,
-  "pep621": {
-    "enabled": true
-  },
+  "automerge": false,
   "lockFileMaintenance": {
     "enabled": true,
-    "automerge": true
+    "automerge": false,
+    "labels": [
+      "manual-review",
+      "security-sensitive"
+    ]
   },
   "ignorePaths": [
     ".python-version"
   ],
   "packageRules": [
-    {
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ],
-      "automerge": true,
-      "labels": [
-        "automerge"
-      ],
-      "matchPackageNames": [
-        "*"
-      ]
-    },
     {
       "groupName": "github-actions",
       "matchManagers": [
         "github-actions"
       ],
-      "matchUpdateTypes": [
-        "digest",
-        "minor",
-        "patch"
-      ],
-      "pinDigests": true,
-      "automerge": true,
       "labels": [
-        "automerge",
-        "github-actions"
+        "github-actions",
+        "manual-review",
+        "security-sensitive"
       ]
     },
     {
@@ -58,16 +40,10 @@
         "dockerfile",
         "docker-compose"
       ],
-      "pinDigests": true
-    },
-    {
-      "groupName": "pre-commit",
-      "matchManagers": [
-        "pre-commit"
-      ],
-      "automerge": true,
       "labels": [
-        "automerge"
+        "docker",
+        "manual-review",
+        "security-sensitive"
       ]
     }
   ],

.github/workflows/ci.yml

@@ -33,13 +33,15 @@ jobs:
       models: ${{ steps.filter.outputs.models }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
       - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
         id: filter
         with:
           filters: |
             models:
               - 'relab_rpi_cam_models/**'
-              - 'tests/unit/test_contract_package.py'
+              - 'tests/unit/core/test_contract_package.py'
               - '.github/workflows/models-check-reusable.yml'
               - 'pyproject.toml'
               - 'uv.lock'
@@ -50,6 +52,8 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
@@ -69,6 +73,8 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
@@ -85,19 +91,6 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: false
 
-  audit:
-    name: Dependency Audit
-    if: github.event_name != 'pull_request'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
-        with:
-          enable-cache: true
-          cache-dependency-glob: uv.lock
-      - run: uv audit --preview-features audit --locked --no-dev
-
   models-check:
     name: Models Check
     needs: changes

.github/workflows/models-check-reusable.yml

@@ -7,29 +7,23 @@ on:
         required: false
         type: string
         default: "3.13"
-      runs_on:
-        required: false
-        type: string
-        default: "ubuntu-24.04"
       upload_artifact:
         required: false
         type: boolean
         default: false
-      artifact_name:
-        required: false
-        type: string
-        default: "relab-rpi-cam-models-dist"
 
 permissions:
   contents: read
 
 jobs:
   models-check:
     name: relab-rpi-cam-models Checks
-    runs-on: ${{ inputs.runs_on }}
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
@@ -69,6 +63,6 @@ jobs:
         if: inputs.upload_artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: ${{ inputs.artifact_name }}
+          name: relab-rpi-cam-models-dist
           path: dist/relab-rpi-cam-models/*
           retention-days: 7

.github/workflows/models-publish.yml

@@ -19,6 +19,8 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
@@ -34,7 +36,6 @@ jobs:
     with:
       python_version: "3.13"
       upload_artifact: true
-      artifact_name: relab-rpi-cam-models-dist
 
   publish:
     name: Publish to PyPI

.github/workflows/release.yml

@@ -36,4 +36,4 @@ jobs:
         if: steps.cz.outputs.next_version != steps.cz.outputs.previous_version
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release create "${{ steps.cz.outputs.next_version }}" --title "${{ steps.cz.outputs.next_version }}" --generate-notes
+        run: gh release create "v${{ steps.cz.outputs.next_version }}" --title "v${{ steps.cz.outputs.next_version }}" --generate-notes

.github/workflows/security.yml

@@ -0,0 +1,97 @@
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+# spell-checker: ignore aquasecurity gacts SARIF
+
+name: Security
+
+on:
+  pull_request:
+    branches: [ main ]
+  push:
+    branches: [ main ]
+  schedule:
+    - cron: "0 3 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    name: Detect Changes
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      container: ${{ steps.filter.outputs.container }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
+        id: filter
+        with:
+          filters: |
+            container:
+              - 'Dockerfile'
+              - 'pyproject.toml'
+              - 'uv.lock'
+
+  secret-scan:
+    name: Secret Scan
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Run gitleaks
+        uses: gacts/gitleaks@c9a0338361dc45a01aa7ebaaa5330179f3c62873
+        with:
+          version: 8.30.1
+
+  dependency-audit:
+    name: Dependency Audit
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - run: uv audit --preview-features audit --locked --no-dev
+
+  container-scan:
+    name: Container Scan
+    needs: changes
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || needs.changes.outputs.container == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+      - name: Build image
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
+        with:
+          context: .
+          file: Dockerfile
+          load: true
+          pull: true
+          tags: relab-rpi-cam-plugin:${{ github.sha }}
+      - name: Scan image with Trivy
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
+        with:
+          image-ref: relab-rpi-cam-plugin:${{ github.sha }}
+          format: table
+          exit-code: "1"
+          ignore-unfixed: true
+          severity: HIGH,CRITICAL

.pre-commit-config.yaml

@@ -16,7 +16,7 @@ repos:
             args: [ "--markdown-linebreak-ext", "md" ] # Preserve Markdown hard line breaks.
 
     - repo: https://github.com/gitleaks/gitleaks # Detect secrets in commits.
-      rev: v8.30.0
+      rev: v8.30.1
       hooks:
           - id: gitleaks
 
@@ -51,3 +51,9 @@ repos:
             language: system
             types: [ python ]
             pass_filenames: false
+          - id: openapi-schema-check
+            name: openapi-schema-check
+            entry: uv run python -m scripts.export_openapi --check
+            language: system
+            files: ^(?:app/.*|scripts/export_openapi\.py|openapi\.rpi-cam\.json|justfile|pyproject\.toml|uv\.lock)$
+            pass_filenames: false