fix: remove hardcoded secrets across all services

.env.example

@@ -1,25 +1,73 @@
 # Atlas Workforce System — Environment Template
 # Copy this file to .env and fill in your values.
 # NEVER commit the actual .env file to version control.
+#
+# ╔════════════════════════════════════════════════════════════════════════════╗
+# ║  IMPORTANT: Generate strong secrets for production                       ║
+# ║  Use: openssl rand -base64 64                                           ║
+# ║  Never use default/placeholder values in a deployed environment          ║
+# ╚════════════════════════════════════════════════════════════════════════════╝
+
 NODE_ENV=development
 
-# API Gateway
+# ── API Gateway ─────────────────────────────────────────────────────────────
 PORT=8080
-JWT_SECRET=change-me-to-a-long-random-string
+JWT_SECRET=
 ALLOWED_ORIGINS=http://localhost:3000
-AUTH_SERVICE_URL=http://localhost:8010
-EMPLOYEE_SERVICE_URL=http://localhost:8001
-PAYROLL_SERVICE_URL=http://localhost:8002
-ANALYTICS_SERVICE_URL=http://localhost:8003
-NOTIFICATION_SERVICE_URL=http://localhost:8004
-ATTENDANCE_SERVICE_URL=http://localhost:8005
-LEAVE_SERVICE_URL=http://localhost:8006
-REDIS_URL=redis://localhost:6379
-
-# Auth Service
-POSTGRES_URL=postgresql://atlas_user:atlas_password@localhost:5432/atlas_db
+AUTH_SERVICE_URL=http://auth-service:8010
+EMPLOYEE_SERVICE_URL=http://employee-service:8001
+PAYROLL_SERVICE_URL=http://payroll-service:8002
+ANALYTICS_SERVICE_URL=http://analytics-service:8003
+NOTIFICATION_SERVICE_URL=http://notification-service:8004
+ATTENDANCE_SERVICE_URL=http://attendance-service:8005
+LEAVE_SERVICE_URL=http://leave-service:8006
+REDIS_URL=redis://redis:6379
+INTERNAL_JWT_SECRET=
+AUDIT_INTERNAL_KEY=
+
+# ── Auth Service ────────────────────────────────────────────────────────────
+POSTGRES_URL=postgresql://atlas_user:atlas_password@postgres:5432/atlas_db
 POSTGRES_SSL=false
-ADMIN_DEFAULT_PASSWORD=ChangeMe123!
+ADMIN_DEFAULT_PASSWORD=
+JWT_SECRET=
+AUDIT_INTERNAL_KEY=
+SCIM_API_KEY=
+
+# ── Employee Service ────────────────────────────────────────────────────────
+MONGO_USER=admin
+MONGO_PASSWORD=
+MONGO_DB=atlas_db
+MONGO_URL=mongodb://admin:admin_password@mongodb:27017/atlas_db?authSource=admin
+INTERNAL_KEY=
+RABBITMQ_USER=guest
+RABBITMQ_PASSWORD=
+
+# ── Analytics Service ───────────────────────────────────────────────────────
+POSTGRES_USER=atlas_user
+POSTGRES_PASSWORD=
+POSTGRES_HOST=postgres
+POSTGRES_DB=atlas_db
+INTERNAL_JWT_SECRET=
+RABBITMQ_USER=guest
+RABBITMQ_PASSWORD=
+
+# ── Security Service ────────────────────────────────────────────────────────
+DATABASE_URL=postgresql://atlas_user:atlas_password@postgres:5432/atlas_security
+INTERNAL_API_KEY=
+
+# ── Integration Service ─────────────────────────────────────────────────────
+INTERNAL_API_KEY=
+
+# ── Notification Service ────────────────────────────────────────────────────
+INTERNAL_JWT_SECRET=
+
+# ── Attendance Service ──────────────────────────────────────────────────────
+INTERNAL_JWT_SECRET=
+
+# ── Audit Compliance Service ────────────────────────────────────────────────
+INTERNAL_API_KEY=
 
-# Employee Service
-MONGO_URL=mongodb://admin:admin_password@localhost:27017/atlas_db?authSource=admin
+# ── Observability ───────────────────────────────────────────────────────────
+OPENAI_API_KEY=
+WEBAUTHN_RP_ID=localhost
+WEBAUTHN_ORIGIN=http://localhost:3000

services/analytics-python-service/main.py

@@ -107,8 +107,8 @@ async def internal_auth_middleware(request: Request, call_next):
     return await call_next(request)
 
 
-POSTGRES_USER = os.environ.get("POSTGRES_USER", "atlas_user")
-POSTGRES_PASSWORD = os.environ.get("POSTGRES_PASSWORD", "atlas_password")
+POSTGRES_USER = os.environ["POSTGRES_USER"]
+POSTGRES_PASSWORD = os.environ["POSTGRES_PASSWORD"]
 POSTGRES_HOST = os.environ.get("POSTGRES_HOST", "postgres")
 POSTGRES_DB = os.environ.get("POSTGRES_DB", "atlas_db")
 DATABASE_URL = os.environ.get(
@@ -134,8 +134,8 @@ def health_check():
 
 RABBITMQ_HOST = os.environ.get("RABBITMQ_HOST", "localhost")
 RABBITMQ_PORT = int(os.environ.get("RABBITMQ_PORT", "5672"))
-RABBITMQ_USER = os.environ.get("RABBITMQ_USER", "guest")
-RABBITMQ_PASSWORD = os.environ.get("RABBITMQ_PASSWORD", "guest")
+RABBITMQ_USER = os.environ["RABBITMQ_USER"]
+RABBITMQ_PASSWORD = os.environ["RABBITMQ_PASSWORD"]
 
 EMPLOYEE_SERVICE_URL = os.environ.get("EMPLOYEE_SERVICE_URL", "http://employee-service:8001")
 

services/auth-service/index.js

@@ -57,7 +57,7 @@ const AUDIT_INTERNAL_KEY = process.env.AUDIT_INTERNAL_KEY;
 const SAML_IDP_SSO_URL = process.env.SAML_IDP_SSO_URL || 'https://idp.example.com/sso';
 const SAML_IDP_ENTITY_ID = process.env.SAML_IDP_ENTITY_ID || 'https://idp.example.com/metadata';
 const SAML_IDP_CERT = (process.env.SAML_IDP_CERT || '').replace(/\\n/g, '\n');
-const SCIM_API_KEY = process.env.SCIM_API_KEY || 'change-scim-api-key-in-production';
+const SCIM_API_KEY = process.env.SCIM_API_KEY;
 
 if (!JWT_SECRET) {
   console.error('FATAL: JWT_SECRET environment variable is required');

services/employee-python-service/main.py

@@ -53,8 +53,8 @@ def log_event(level: str, event: str, **kwargs):
 # ------------------------------------------------
 # Configuration
 # ------------------------------------------------
-MONGO_USER = os.environ.get("MONGO_USER", "admin")
-MONGO_PASSWORD = os.environ.get("MONGO_PASSWORD", "admin_password")
+MONGO_USER = os.environ["MONGO_USER"]
+MONGO_PASSWORD = os.environ["MONGO_PASSWORD"]
 MONGO_HOST = os.environ.get("MONGO_HOST", "localhost")
 MONGO_DB = os.environ.get("MONGO_DB", "atlas_db")
 MONGO_URL = os.environ.get(
@@ -63,12 +63,12 @@ def log_event(level: str, event: str, **kwargs):
 )
 DB_NAME = "atlas_db"
 
-INTERNAL_KEY = os.environ.get("INTERNAL_KEY", "change-me-in-production")
+INTERNAL_KEY = os.environ["INTERNAL_KEY"]
 
 RABBITMQ_HOST = os.environ.get("RABBITMQ_HOST", "localhost")
 RABBITMQ_PORT = int(os.environ.get("RABBITMQ_PORT", "5672"))
-RABBITMQ_USER = os.environ.get("RABBITMQ_USER", "guest")
-RABBITMQ_PASSWORD = os.environ.get("RABBITMQ_PASSWORD", "guest")
+RABBITMQ_USER = os.environ["RABBITMQ_USER"]
+RABBITMQ_PASSWORD = os.environ["RABBITMQ_PASSWORD"]
 
 client = AsyncIOMotorClient(MONGO_URL)
 db = client[DB_NAME]

services/security-service/main.py

@@ -47,8 +47,8 @@
 
 load_dotenv()
 
-DATABASE_URL = os.getenv("DATABASE_URL", "postgresql://atlas:atlas_pass@localhost:5432/atlas_security")
-INTERNAL_API_KEY = os.getenv("INTERNAL_API_KEY", "svc-security-secret-key-change-in-production")
+DATABASE_URL = os.environ["DATABASE_URL"]
+INTERNAL_API_KEY = os.environ["INTERNAL_API_KEY"]
 MAX_PAGE_SIZE = int(os.getenv("MAX_PAGE_SIZE", "100"))
 CORS_ORIGINS = os.getenv("CORS_ORIGINS", "http://localhost:3000")