From 4d95b783b490d6431c285c23fd948095ce4f7d5d Mon Sep 17 00:00:00 2001 From: Nathan Broadbent Date: Tue, 27 Oct 2026 12:13:31 +1300 Subject: [PATCH 1/2] docs: turning on Convox's system-env-disable: the name=value format, running processes, rotating the password --- docs/src/content/docs/security/hardening.mdx | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/src/content/docs/security/hardening.mdx b/docs/src/content/docs/security/hardening.mdx index 0e3f4d09..c3c4c87b 100644 --- a/docs/src/content/docs/security/hardening.mdx +++ b/docs/src/content/docs/security/hardening.mdx @@ -194,7 +194,12 @@ only when it's run with `--write`. See [Env vars](/user-guide/cli/commands/#env- Convox gives every app process `RACK_URL`, which holds the rack's API password, unless the rack's `system-env-disable` feature gate is on. The gateway keeps it from every command it runs, but the app's own processes still have it, and an `exec` can read it from the process it runs in. The gate also removes `RACK`, which -the gateway reads, so set `RACK` on the gateway app before turning the gate on. +the gateway reads, so set `RACK` on the gateway app (and any other app that reads it) before turning the gate on: +`convox rack params set api_feature_gates=system-env-disable=true`, or `api_feature_gates = +"system-env-disable=true"` in the rack's Terraform. Convox reads each gate as `name=value` and ignores a bare name. +New processes start without `RACK` and `RACK_URL` at once; running ones keep them until their app's next promote. +Then consider rotating the rack's API password, which every process could read until now, and the gateway's +`RACK_TOKEN` with it. ### Secret Storage From 8c20dec6c572318204e273727ca3bc480bf4a6d8 Mon Sep 17 00:00:00 2001 From: Nathan Broadbent Date: Tue, 27 Oct 2026 12:24:40 +1300 Subject: [PATCH 2/2] docs: the gate removes Convox's RACK, not one you set; rotate the rack password after it --- docs/src/content/docs/security/hardening.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/src/content/docs/security/hardening.mdx b/docs/src/content/docs/security/hardening.mdx index c3c4c87b..96a2373a 100644 --- a/docs/src/content/docs/security/hardening.mdx +++ b/docs/src/content/docs/security/hardening.mdx @@ -197,9 +197,9 @@ processes still have it, and an `exec` can read it from the process it runs in. the gateway reads, so set `RACK` on the gateway app (and any other app that reads it) before turning the gate on: `convox rack params set api_feature_gates=system-env-disable=true`, or `api_feature_gates = "system-env-disable=true"` in the rack's Terraform. Convox reads each gate as `name=value` and ignores a bare name. -New processes start without `RACK` and `RACK_URL` at once; running ones keep them until their app's next promote. -Then consider rotating the rack's API password, which every process could read until now, and the gateway's -`RACK_TOKEN` with it. +New processes stop getting Convox's `RACK` and `RACK_URL` at once (a `RACK` you set yourself stays); running ones +keep them until their app's next promote. Then rotate the rack's API password, which every process could read until +now, and set the gateway's `RACK_TOKEN` to the new one. ### Secret Storage