Skip to content

chore(aws): codify iCaptcha enforce in the EC2 node Terraform #139

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kevincodex1 merged 1 commit into from
Jul 1, 2026
Merged

chore(aws): codify iCaptcha enforce in the EC2 node Terraform #139

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions infra/aws/compose.yaml.tftpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,10 @@ services:
GITLAWB_P2P_PORT: "${p2p_port}"
GITLAWB_REPOS_DIR: /data/repos
GITLAWB_KEY: /data/keys/identity.pem
# iCaptcha proof-of-intelligence gate (spam protection on create/fork/register)
ICAPTCHA_MODE: ${icaptcha_mode}
ICAPTCHA_PUBKEY: ${icaptcha_pubkey}
ICAPTCHA_REQUIRED_LEVEL: "${icaptcha_required_level}"
Comment on lines +61 to +64

@coderabbitai coderabbitai Bot Jul 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

sed -n '1,120p' infra/aws/compose.yaml.tftpl

Repository: Gitlawb/node

Length of output: 3370

🏁 Script executed:

rg -n "icaptcha_mode|docker compose|compose version|compose plugin|go-yaml|compose.yaml.tftpl" .

Repository: Gitlawb/node

Length of output: 2309

🏁 Script executed:

sed -n '80,120p' infra/aws/variables.tf && printf '\n----\n' && sed -n '1,160p' infra/aws/user-data.sh.tftpl

Repository: Gitlawb/node

Length of output: 5833

🌐 Web query:

Docker Compose v2.32.4 YAML boolean off on environment mapping compose-go yaml.v3 behavior

💡 Result:

In Docker Compose, including version 2.32.4, the use of unquoted boolean-like values—such as "off", "on", "yes", or "no"—within an environment mapping can cause unexpected behavior or configuration errors because the underlying YAML parser may interpret these as boolean types rather than strings [1][2]. This behavior is primarily a result of Docker Compose using the go-yaml/v3 library for parsing YAML files [3][4]. While YAML 1.2 specifications removed these values from the default boolean set, go-yaml/v3 maintains limited backward compatibility with YAML 1.1 [4]: 1. Boolean Interpretation: When a YAML scalar is decoded into a typed boolean field, values like "off", "on", "yes", and "no" are correctly treated as booleans [4]. However, for environment variable definitions, Docker Compose expects string values [2]. 2. Contextual Parsing: If the YAML parser encounters these values in a context where it expects a string, it may still parse them based on its internal rules, potentially leading to the variable being set as a boolean literal (true/false) instead of the intended string "off" or "on" [2]. 3. Impact on Environment Variables: Docker Compose mandates that any boolean-like value used in the environment section must be enclosed in quotes (e.g., VAR: 'off') [5][6]. Quoting ensures the value is treated strictly as a string, preventing the parser from attempting to convert it into a boolean type [6][2]. If you omit the quotes, you risk configuration errors or the application receiving a boolean type rather than the literal string "off" or "on," which often causes failures in application-level environment variable parsing [2][7]. To ensure consistency and avoid errors, always quote these values in your compose files [6][8].

Citations:

Quote ICAPTCHA_MODE

icaptcha_mode accepts off, and this Compose environment entry is still unquoted. Docker Compose can treat boolean-like scalars as YAML values here, so off may not reach the container as the literal string. Quoting this field avoids a startup/config mismatch.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@infra/aws/compose.yaml.tftpl` around lines 61 - 64, The ICAPTCHA_MODE entry
in the Compose template is still unquoted, so YAML may coerce values like off
instead of passing the literal string. Update the environment block in
compose.yaml.tftpl so ICAPTCHA_MODE is quoted like the other string values,
keeping the container config aligned with the icaptcha_mode setting.

GITLAWB_PUBLIC_URL: $${GITLAWB_PUBLIC_URL}
GITLAWB_BOOTSTRAP_PEERS: $${GITLAWB_BOOTSTRAP_PEERS}
GITLAWB_AUTO_SYNC: $${GITLAWB_AUTO_SYNC}
Expand Down
23 changes: 13 additions & 10 deletions infra/aws/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,16 +290,19 @@ locals {
)

compose_yaml = templatefile("${path.module}/compose.yaml.tftpl", {
image_repo = local.image_repo
image_tag = var.image_tag
domain_name = var.domain_name
db_host = var.use_rds ? aws_db_instance.node[0].address : ""
gitlawb_port = var.gitlawb_port
p2p_port = var.gitlawb_p2p_port
metrics_port = var.metrics_port
expose_metrics = local.expose_metrics
pg_user = var.postgres_user
pg_db = var.postgres_db
image_repo = local.image_repo
image_tag = var.image_tag
domain_name = var.domain_name
db_host = var.use_rds ? aws_db_instance.node[0].address : ""
gitlawb_port = var.gitlawb_port
p2p_port = var.gitlawb_p2p_port
metrics_port = var.metrics_port
expose_metrics = local.expose_metrics
pg_user = var.postgres_user
pg_db = var.postgres_db
icaptcha_mode = var.icaptcha_mode
icaptcha_pubkey = var.icaptcha_pubkey
icaptcha_required_level = var.icaptcha_required_level
})

user_data = templatefile("${path.module}/user-data.sh.tftpl", {
Expand Down
22 changes: 22 additions & 0 deletions infra/aws/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,28 @@ variable "image_tag" {
default = "latest"
}

# ---------------------------------------------------------------------------
# iCaptcha proof-of-intelligence gate (spam protection on writes)
# ---------------------------------------------------------------------------

variable "icaptcha_mode" {
description = "iCaptcha gate mode: off | shadow | enforce. The live gitlawb network enforces."
type = string
default = "enforce"
}

variable "icaptcha_pubkey" {
description = "base64url Ed25519 public key of the iCaptcha service, pinned so startup doesn't depend on fetching it. This is the live icaptcha.gitlawb.com key."
type = string
default = "xjyPNqIbvc9U-kwXW6u9mDqRJ7E2UUMOaJdUWhpEXq8"
}

variable "icaptcha_required_level" {
description = "Minimum iCaptcha proof level required to pass the gate."
type = number
default = 3
}

# ---------------------------------------------------------------------------
# Networking / ingress
# ---------------------------------------------------------------------------
Expand Down
Loading