scour-secrets 0.20.0

# GitLab — gitlab.rb Omnibus config, .gitlab-ci.yml CI/CD variables, Helm chart
# values, and the two support-bundle formats GitLab tooling produces:
#   - GitLabSOS tarballs (Omnibus): runit logs at var/log/gitlab/<service>/current,
#     gitlab-rails/*.log NDJSON logs, etc/gitlab/gitlab.rb
#   - kubeSOS tarballs (cloud-native chart): helm values dumps
#     (all_values*.yaml, user_supplied_values*.yaml, helm_manifest.yaml),
#     kubectl describe output, and <app>_<container>.log pod logs
# GitLabSOS bundles also carry nginx logs and etc/fstab — combine with the
# nginx and fstab apps (--app gitlab --app nginx --app fstab) for full coverage.

# --- Omnibus gitlab.rb (Ruby key = 'value' DSL) ---
# Sensitive key substrings are a superset of
# gitlab-scrubber/internal/scrubber/unstructured/gitlab_rb.go sensitiveKeyPatterns:
# authorization, aws_access_key, app_id, tenant_id, client_id, accesskey,
# secretkey, accountkey, gitlab_application_id, key_base, secret, _key, bucket,
# bind_dn, accountname, _account_name, _fingerprint, token — plus "password"
# (handled more aggressively in the scrubber) and "_dsn" (kept here even though
# the scrubber dropped it; Sentry DSNs embed an auth key).
- processor: key-value
  extensions: [".rb"]
  include: ["gitlab.rb", "*/gitlab.rb"]
  options:
    delimiter: "="
    secondary_delimiter: "=>,:"
    comment_prefix: "#"
  fields:
    - pattern: "*password*"
      category: custom:password
      label: gitlab_rb_password
    - pattern: "*secret*"
      category: auth_token
      label: gitlab_rb_secret
    - pattern: "*token*"
      category: auth_token
      label: gitlab_rb_token
    - pattern: "*_key*"
      category: auth_token
      label: gitlab_rb_key
    - pattern: "*key_base*"
      category: auth_token
      label: gitlab_rb_key_base
    - pattern: "*authorization*"
      category: auth_token
      label: gitlab_rb_authorization
    - pattern: "*aws_access_key*"
      category: auth_token
      label: gitlab_rb_aws_access_key
    - pattern: "*accesskey*"
      category: auth_token
      label: gitlab_rb_accesskey
    - pattern: "*secretkey*"
      category: auth_token
      label: gitlab_rb_secretkey
    - pattern: "*accountkey*"
      category: auth_token
      label: gitlab_rb_accountkey
    - pattern: "*bind_dn*"
      category: auth_token
      label: gitlab_rb_ldap_bind_dn
    - pattern: "*_fingerprint*"
      category: auth_token
      label: gitlab_rb_fingerprint
    # OAuth/Azure/object-store identifiers — also in gitlab-scrubber's
    # sensitiveKeyPatterns but previously omitted here.
    - pattern: "*client_id*"
      category: auth_token
      label: gitlab_rb_client_id
    - pattern: "*app_id*"
      category: auth_token
      label: gitlab_rb_app_id
    - pattern: "*application_id*"
      category: auth_token
      label: gitlab_rb_application_id
    - pattern: "*tenant_id*"
      category: auth_token
      label: gitlab_rb_tenant_id
    - pattern: "*accountname*"
      category: auth_token
      label: gitlab_rb_account_name
    - pattern: "*_account_name*"
      category: auth_token
      label: gitlab_rb_account_name2
    - pattern: "*bucket*"
      category: auth_token
      label: gitlab_rb_bucket
    - pattern: "*_dsn*"
      category: url
      label: gitlab_rb_sentry_dsn

# --- .gitlab-ci.yml and GitLab CI config includes ---
- processor: yaml
  extensions: [".yml", ".yaml"]
  include:
    - ".gitlab-ci.yml"
    - "gitlab-ci.yml"
    - "*/.gitlab-ci.yml"
  fields:
    # Top-level variables: block
    - pattern: "variables.*"
      category: auth_token
      label: ci_variable
    # Job-level variables: blocks (<job>.variables.FOO)
    - pattern: "*.variables.*"
      category: auth_token
      label: ci_job_variable

# --- GitLab Helm chart values (gitlab-specific deep paths) ---
# Note: broad *.password / *.token patterns intentionally catch inlined credentials
# in user override files. K8s secret reference fields (secret: name, key: name)
# are also matched — redacting object names is acceptable in this context.
# The user_supplied_values*/all_values* names are the `helm get values` dumps
# kubeSOS writes (including per-revision all_values_rev_<n>.yaml) — the
# --all form inlines every credential the chart knows about.
- processor: yaml
  extensions: [".yml", ".yaml"]
  include:
    - "values.yaml"
    - "values-*.yaml"
    - "gitlab-values.yaml"
    - "gitlab-values-*.yaml"
    - "user_supplied_values.yaml"
    - "user_supplied_values_rev_*.yaml"
    - "all_values.yaml"
    - "all_values_rev_*.yaml"
  fields:
    # Generic credential fields (catches inlined passwords/tokens anywhere)
    - pattern: "*.password"
      category: custom:password
      label: gitlab_helm_password

    - pattern: "*.token"
      category: auth_token
      label: gitlab_helm_token

    - pattern: "*.authToken"
      category: auth_token
      label: gitlab_helm_auth_token

    # GitLab-specific global paths
    - pattern: "global.smtp.password"
      category: custom:password
      label: gitlab_helm_smtp_password
    - pattern: "global.psql.password"
      category: custom:password
      label: gitlab_helm_psql_password
    - pattern: "global.redis.auth.secret"
      category: auth_token
      label: gitlab_helm_redis_auth_secret
    - pattern: "global.gitaly.authToken"
      category: auth_token
      label: gitlab_helm_gitaly_auth_token
    - pattern: "global.initialRootPassword"
      category: custom:password
      label: gitlab_helm_initial_root_password
    # MinIO (used as object storage in GitLab Helm deployments)
    - pattern: "minio.accessKey"
      category: auth_token
      label: gitlab_helm_minio_access_key
    - pattern: "minio.secretKey"
      category: auth_token
      label: gitlab_helm_minio_secret_key
    # KAS and Pages secrets
    - pattern: "gitlab.kas.*.secret"
      category: auth_token
      label: gitlab_helm_kas_secret
    - pattern: "gitlab.gitlab-pages.*.secret"
      category: auth_token
      label: gitlab_helm_pages_secret
    # Registry storage credentials (S3/GCS/Azure backends)
    - pattern: "registry.storage.*.accesskey"
      category: auth_token
      label: gitlab_helm_registry_access_key
    - pattern: "registry.storage.*.secretkey"
      category: auth_token
      label: gitlab_helm_registry_secret_key

# --- Rendered chart manifests (helm get manifest > helm_manifest.yaml, kubeSOS) ---
# Multi-document YAML; can embed Secret objects and literal container env values.
- processor: yaml
  extensions: [".yml", ".yaml"]
  include: ["helm_manifest.yaml"]
  fields:
    - pattern: "data.*"
      category: auth_token
      label: gitlab_manifest_secret_data
    - pattern: "stringData.*"
      category: auth_token
      label: gitlab_manifest_secret_string_data
    - pattern: "spec.template.spec.containers.env.value"
      category: auth_token
      label: gitlab_manifest_env_value
      min_length: 8
    - pattern: "spec.template.spec.initContainers.env.value"
      category: auth_token
      label: gitlab_manifest_init_env_value
      min_length: 8

# --- Omnibus master secret store (/etc/gitlab/gitlab-secrets.json) ---
# Every leaf is secret material (secret_key_base, db_key_base, component
# tokens, PEM keys). min_length skips structural short values.
- processor: json
  extensions: [".json"]
  include: ["gitlab-secrets.json"]
  fields:
    - pattern: "*"
      category: auth_token
      label: gitlab_secrets_json
      min_length: 8

# --- GitLab Rails production JSON log (production_json.log) ---
# Sensitive fields per gitlab-scrubber structured/field_extractors.go:
# keys containing "user"/"author", "ip", "email", project path fields.
# webservice_webservice*.log is the kubeSOS pod-log name for the Rails
# container (kubectl logs <app>_<container>.log naming).
# skip_invalid: log streams interleave plain-text lines with NDJSON; those
# lines fall through to the scanner pass instead of failing the file.
- processor: jsonl
  extensions: [".log"]
  include:
    - "production_json.log"
    - "webservice_webservice*.log"
  options:
    skip_invalid: "true"
  fields:
    # Request params array ({"key": ..., "value": ...}) — values carry
    # user-submitted data (project paths, tokens, emails). The "key" member is
    # a metadata label and is deliberately not matched.
    - pattern: "params.value"
      category: auth_token
      label: rails_log_params_value
      min_length: 4
    - pattern: "username"
      category: name
      label: rails_log_username
    - pattern: "remote_ip"
      category: ipv4
      label: rails_log_remote_ip
    - pattern: "meta.user"
      category: name
      label: rails_log_meta_user
    - pattern: "meta.remote_ip"
      category: ipv4
      label: rails_log_meta_remote_ip
    - pattern: "meta.caller_id"
      category: name
      label: rails_log_meta_caller_id
    - pattern: "meta.project"
      category: name
      label: rails_log_meta_project
    - pattern: "meta.namespace"
      category: name
      label: rails_log_meta_namespace
    - pattern: "meta.root_namespace"
      category: name
      label: rails_log_meta_root_namespace

# --- GitLab Rails API JSON log (api_json.log) ---
# Same NDJSON shape as production_json.log, with the same params array.
- processor: jsonl
  extensions: [".log"]
  include:
    - "api_json.log"
  options:
    skip_invalid: "true"
  fields:
    - pattern: "params.value"
      category: auth_token
      label: api_log_params_value
      min_length: 4
    - pattern: "username"
      category: name
      label: api_log_username
    - pattern: "remote_ip"
      category: ipv4
      label: api_log_remote_ip
    - pattern: "meta.user"
      category: name
      label: api_log_meta_user
    - pattern: "meta.remote_ip"
      category: ipv4
      label: api_log_meta_remote_ip
    - pattern: "meta.project"
      category: name
      label: api_log_meta_project
    - pattern: "meta.namespace"
      category: name
      label: api_log_meta_namespace
    - pattern: "meta.root_namespace"
      category: name
      label: api_log_meta_root_namespace

# --- GitLab Rails application JSON log (application_json.log) ---
- processor: jsonl
  extensions: [".log"]
  include:
    - "application_json.log"
  options:
    skip_invalid: "true"
  fields:
    - pattern: "username"
      category: name
      label: app_log_username
    - pattern: "meta.user"
      category: name
      label: app_log_meta_user
    - pattern: "meta.remote_ip"
      category: ipv4
      label: app_log_meta_remote_ip
    - pattern: "meta.project"
      category: name
      label: app_log_meta_project
    - pattern: "meta.namespace"
      category: name
      label: app_log_meta_namespace
    - pattern: "meta.root_namespace"
      category: name
      label: app_log_meta_root_namespace

# --- Product usage data log (product_usage_data.log) ---
# The payload field is an opaque Snowplow event blob whose base64-encoded
# context embeds hostnames and hashed user IDs — scrub it entirely
# (mirrors gitlab-scrubber's [SCRUBBED] override).
- processor: jsonl
  extensions: [".log"]
  include:
    - "product_usage_data.log"
  options:
    skip_invalid: "true"
  fields:
    - pattern: "payload"
      category: auth_token
      label: product_usage_payload

# --- Sidekiq JSON log ---
# "args" is scrubbed entirely — job arguments can contain arbitrary secrets.
# min_length keeps trivial args (single digits, "default", queue names) out
# of the store: as discovered literals they rewrite unrelated digits and
# words across the whole bundle. Real credentials are ≥8 chars.
# GitLabSOS stores this log as the extensionless runit file
# var/log/gitlab/sidekiq/current ('""' passes any name; the include list
# gates). kubeSOS stores it as sidekiq_<container>.log.
- processor: jsonl
  extensions: [""]
  include:
    - "sidekiq.log"
    - "sidekiq_*.log"
    - "**/sidekiq/current"
  options:
    skip_invalid: "true"
  fields:
    - pattern: "args"
      category: auth_token
      label: sidekiq_log_args
      min_length: 8
    - pattern: "meta.user"
      category: name
      label: sidekiq_log_meta_user
    - pattern: "meta.project"
      category: name
      label: sidekiq_log_meta_project
    - pattern: "meta.remote_ip"
      category: ipv4
      label: sidekiq_log_meta_remote_ip

# --- GitLab Workhorse log ---
# GitLabSOS: var/log/gitlab/gitlab-workhorse/current (extensionless runit).
# kubeSOS: webservice_workhorse.log (workhorse runs as a container in the
# webservice pod).
- processor: jsonl
  extensions: [""]
  include:
    - "gitlab-workhorse.log"
    - "workhorse.log"
    - "*_workhorse*.log"
    - "**/gitlab-workhorse/current"
  options:
    skip_invalid: "true"
  fields:
    - pattern: "remote_addr"
      category: ipv4
      label: workhorse_log_remote_addr
    - pattern: "host"
      category: hostname
      label: workhorse_log_host
    - pattern: "uri"
      category: url
      label: workhorse_log_uri
      # keep "/" health-check probes as-is
      min_length: 2

# --- Gitaly log ---
# grpc.request.glProjectPath contains the group/project path.
# grpc.request.repoPath is a content-addressed hash path — not user data, skip.
# GitLabSOS: var/log/gitlab/gitaly/current. kubeSOS: gitaly_gitaly.log.
- processor: jsonl
  extensions: [""]
  include:
    - "gitaly.log"
    - "gitaly_*.log"
    - "**/gitaly/current"
  options:
    skip_invalid: "true"
  fields:
    - pattern: "grpc.request.glProjectPath"
      category: name
      label: gitaly_log_project_path
    - pattern: "peer.address"
      category: ipv4
      label: gitaly_log_peer_address

# --- GitLab Shell log (gitlab-shell.log / gitlab_shell.log) ---
# originalCommand leaks group/project.git from git-upload-pack / git-receive-pack calls.
# gitlab-shell_*.log is the kubeSOS pod-log name.
- processor: jsonl
  extensions: [".log"]
  include:
    - "gitlab-shell.log"
    - "gitlab_shell.log"
    - "gitlab-shell_*.log"
  options:
    skip_invalid: "true"
  fields:
    - pattern: "username"
      category: name
      label: shell_log_username
    - pattern: "remote_addr"
      category: ipv4
      label: shell_log_remote_addr
    - pattern: "original_command"
      category: name
      label: shell_log_original_command

# --- OS-level captures (GitLabSOS top-level files) ---
# gitlabsos copies bare command outputs (hostname, uname, sysctl_a, ps,
# top_cpu, top_res, dmesg, syslog, …). kernel.hostname seeds the short-form
# hostname into the store, so the phase-2 scanner scrubs it from every file
# that carries it bare (hostname, uname, dmesg, syslog, mail.log,
# gitlab_system_status, gitlabsos.log, prometheus). kernel.domainname covers
# NIS domains — its idle value "(none)" is allowlisted in secrets.yaml.
- processor: key-value
  extensions: [""]
  include: ["sysctl_a", "*/sysctl_a"]
  options:
    delimiter: "="
  fields:
    - pattern: "kernel.hostname"
      category: hostname
      label: os_kernel_hostname
      min_length: 2
    - pattern: "kernel.domainname"
      category: hostname
      label: os_kernel_domainname
      min_length: 2

# --- Process listings (ps, top_cpu, top_res) ---
# The USER column carries OS usernames; the discovered names propagate to
# bare occurrences elsewhere (syslog "sshd: <user>", mail.log). min_length 4
# skips service stubs ("git", "-") and top-preamble tokens; allowlisted
# accounts (root, nobody, …) pass through via the store's allowlist.
- processor: columns
  extensions: [""]
  include: ["ps", "*/ps", "top_cpu", "*/top_cpu", "top_res", "*/top_res"]
  fields:
    - pattern: "USER"
      category: name
      label: os_ps_user
      min_length: 4

# --- kubectl describe dumps (kubeSOS: describe_pods, describe_deployments, …) ---
# `kubectl describe` prints literal values for plain (non-secretRef) env vars
# under Environment:. Extensionless "KEY:  value" lines; only credential-looking
# keys are matched, and min_length skips enum-like short values.
- processor: key-value
  extensions: [""]
  include:
    - "describe_pods"
    - "describe_deployments"
    - "describe_statefulsets"
  options:
    delimiter: ":"
  fields:
    - pattern: "*password*"
      category: custom:password
      label: kubectl_describe_password
      min_length: 8
    - pattern: "*secret*"
      category: auth_token
      label: kubectl_describe_secret
      min_length: 8
    - pattern: "*token*"
      category: auth_token
      label: kubectl_describe_token
      min_length: 8
    - pattern: "*_key*"
      category: auth_token
      label: kubectl_describe_key
      min_length: 8