aios/baseline/diff_log/20260706-auth-gitops-portal-hardening.md

20260706 Auth GitOps Portal Hardening

Version: V1R1C4 Previous: V1R1C3 Timestamp: 2026-07-06T11:05:30Z

User-visible fixes

• Human shortlinks no longer expose baseline/model/run JSON without portal login.
• The cnnetmkt portal has a visible GitOps section for owner/admin users.
• Gitea is served from https://g.cnnetmkt.top/git/ and repository browsing requires login.
• Gitea owner password is synchronized from the cnnetmkt owner account secret.
• The default local Gitea account password is removed and direct login is disabled.

Files

• deploy/nginx/aios-gitops-locations.conf
• deploy/gitea-binary/app.ini.template
• deploy/systemd/aios-gitea-owner-sync.service
• deploy/systemd/aios-gitea-owner-sync.timer
• ops/gitops-migration/sync_gitea_owner_password.sh
• ops/gitops-migration/apply_user_portal_gitops_overlay.sh
• overlays/user-control-center/control/portal_views.py
• overlays/user-control-center/templates/portal/me.html
• baseline/current.json
• config/codex/gitops-online.json
• versions/V1R1C4.json
• docs/release/AIOS_V1R1C4_AUTH_GITOPS_PORTAL.md

Notes

Docker image rebuild was not required for the live fix. The runtime source and running container were patched, and the exact overlay has been added to GitOps so a later image rebuild can reproduce the change.

Secret Log Hygiene

The Gitea owner password sync script uses runuser instead of sudo -u ... --password ..., strips CRLF from sourced owner fields, and does not print passwords or tokens. Archived journal files were rotated/vacuumed after the live script was corrected.