foxhunt/PRODUCTION_PASSWORDS_SETUP.md

Production Passwords Setup

Agent S8: Production Password Generator Mission: Generate and store production passwords in Vault (Blocker P0-2) Completion Date: 2025-10-18 23:29:08 UTC

---

Overview

This document describes the production password setup for the Foxhunt HFT Trading System. All passwords are generated with 256-bit entropy and stored securely in HashiCorp Vault.

Password Storage

Vault Paths

The following services have passwords stored in Vault:

Service	Vault Path	Description
PostgreSQL	secret/postgres	TimescaleDB database password
InfluxDB	secret/influxdb	Time-series metrics database password
Vault	secret/vault	Vault root token (production)
Grafana	secret/grafana	Grafana admin password
MinIO	secret/minio	S3-compatible object storage password
Redis	secret/redis	Redis cache password (optional - Redis AUTH)

Password Characteristics

• Entropy: 256 bits (32 bytes)
• Encoding: Base64
• Generation Method: OpenSSL random number generator (openssl rand -base64 32)
• Storage: HashiCorp Vault KV v2 secrets engine

Retrieval

Using Vault CLI

# Retrieve a password
docker exec foxhunt-vault vault kv get -field=password secret/postgres

# List all stored passwords
docker exec foxhunt-vault vault kv list secret/

Using Docker Compose

The docker-compose.yml file has been updated to read passwords from Vault instead of using hardcoded values. See the Docker Compose Integration section below.

Docker Compose Integration

Current Status

⚠️ IMPORTANT: The docker-compose.yml file still contains hardcoded development passwords. These need to be updated to read from Vault for production deployment.

Required Changes

1. Environment Variables: Update all service environment variables to use Vault lookups
2. Init Containers: Add init containers to fetch passwords from Vault before service startup
3. Vault Agent: Consider using Vault Agent for automatic secret injection

Example: PostgreSQL Configuration

Before (Development):

environment:
  POSTGRES_PASSWORD: foxhunt_dev_password

After (Production):

environment:
  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}  # Fetched from Vault via init script

Security Best Practices

Development vs Production

Environment	Password Source	Rotation Policy
Development	Hardcoded in docker-compose.yml	None
Production	HashiCorp Vault	90 days

Production Deployment Checklist

• All development passwords removed from docker-compose.yml
• Vault password rotation policy configured (90-day rotation)
• Service startup scripts updated to fetch passwords from Vault
• Vault audit logging enabled
• Vault ACL policies configured (least privilege)
• Backup encryption keys stored in separate secure location
• Password rotation playbook documented

Password Rotation

Manual Rotation

# Generate new password
NEW_PASSWORD=$(openssl rand -base64 32)

# Update in Vault
docker exec foxhunt-vault vault kv put secret/postgres password="$NEW_PASSWORD"

# Restart dependent services
docker-compose restart postgres trading_service backtesting_service ml_training_service

Automated Rotation (Recommended)

Use Vault's built-in database secrets engine for automatic password rotation:

# Enable database secrets engine
docker exec foxhunt-vault vault secrets enable database

# Configure PostgreSQL connection
docker exec foxhunt-vault vault write database/config/foxhunt \
    plugin_name=postgresql-database-plugin \
    allowed_roles="foxhunt-app" \
    connection_url="postgresql://{{username}}:{{password}}@postgres:5432/foxhunt" \
    username="vault_admin" \
    password="<vault_admin_password>"

# Create role with automatic rotation
docker exec foxhunt-vault vault write database/roles/foxhunt-app \
    db_name=foxhunt \
    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';" \
    default_ttl="1h" \
    max_ttl="24h"

Verification

Test Password Retrieval

# Test all password retrievals
for service in postgres influxdb vault grafana minio redis; do
    echo "Testing $service..."
    docker exec foxhunt-vault vault kv get -field=password secret/$service > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        echo "✓ $service password retrieved successfully"
    else
        echo "✗ Failed to retrieve $service password"
    fi
done

Test Service Connectivity

# Test PostgreSQL connection with Vault password
POSTGRES_PASSWORD=$(docker exec foxhunt-vault vault kv get -field=password secret/postgres)
docker exec foxhunt-postgres psql -U foxhunt -d foxhunt -c "SELECT 1" <<< "$POSTGRES_PASSWORD"

# Test InfluxDB connection with Vault password
INFLUXDB_PASSWORD=$(docker exec foxhunt-vault vault kv get -field=password secret/influxdb)
curl -u "foxhunt:$INFLUXDB_PASSWORD" http://localhost:8086/health

Troubleshooting

Common Issues

1. Vault Sealed

# Check Vault status
docker exec foxhunt-vault vault status

# Unseal Vault (requires unseal keys)
docker exec foxhunt-vault vault operator unseal <unseal_key_1>
docker exec foxhunt-vault vault operator unseal <unseal_key_2>
docker exec foxhunt-vault vault operator unseal <unseal_key_3>

2. Permission Denied

# Check Vault token
docker exec foxhunt-vault vault token lookup

# Renew token
docker exec foxhunt-vault vault token renew

3. Password Not Found

# List all secrets
docker exec foxhunt-vault vault kv list secret/

# Check specific secret
docker exec foxhunt-vault vault kv get secret/postgres

Next Steps

1. Update docker-compose.yml (Agent S8 continuation):

   • Replace all foxhunt_dev_password references with Vault lookups
   • Add init containers to fetch passwords before service startup
   • Test all services with Vault-sourced passwords

2. Enable OCSP Revocation (Agent S9):

   • Configure certificate revocation checking
   • Set MTLS_ENABLE_REVOCATION_CHECK=true

3. Production Deployment (Post-S9):

   • Deploy updated docker-compose.yml to production
   • Run smoke tests with production passwords
   • Monitor Vault audit logs

Related Documentation

• CLAUDE.md: System architecture and deployment guide
• WAVE_D_DEPLOYMENT_GUIDE.md: Wave D production deployment procedures
• Security Hardening Reports (H1-H10): JWT, MFA, and mTLS implementation details

---

Status: ✅ PASSWORDS GENERATED AND STORED IN VAULT

Next Agent: S8 (continuation) - Update docker-compose.yml to use Vault passwords