WebApp Project

Overview

This repository contains the source code for the WebApp project, covering both frontend and backend components. The project is integrated with a comprehensive CI/CD pipeline, secret scanning, and DevSecOps best practices.

Table of Contents

1. GitHub Actions CI/CD
2. Tech Stack
3. Running the Application
4. Secret Scanning
5. MongoDB Database
6. How to Contribute
7. Troubleshooting & Logs
8. DevSecOps Details
9. Subfolders Information

GitHub Actions CI/CD

Automated pipelines are set up to build, test, and deploy the application using GitHub Actions.

Access Application

You can access the live application at:

• App - https://psdemo.adnovumlabs.com
• API - https://psbg-psdemo.adnovumlabs.com
• Sonar - http://sonar.adnovumlabs.com:9900

Tech Stack

Technology	Description
Node.js	Backend development
React.js	Frontend development
PostgreSQL	Database

Secret Scanning

The project uses tools like Trufflehog and Gitleaks to scan for sensitive data leaks in the codebase. Regular secret scans help ensure security.

9900

SonarQube

Security Scanning Tools

In a DevSecOps environment, integrating various security scanning tools into the CI/CD pipeline is essential. This section details the types of scans implemented in this project, as well as recommended open-source tools for each.

Security Level	Tools Used	Options	Description
Secret Scan	Gitleaks	TruffleHog, GitGuardian	Scans source code and history to detect sensitive information like secrets and tokens.
Infrastructure as Code (IaC) Scan	Checkov, TFLint	Terrascan	Scans Terraform code to detect security vulnerabilities, compliance violations, and misconfigurations.
Application Code Scan (SAST)	SonarQube	Bandit, Semgrep	Static analysis tools to detect code quality issues, vulnerabilities, and potential security flaws in the source code.
Container/Image Scan	Trivy	Clair, Grype	Scans Docker images for vulnerabilities and compliance issues.
Deployment Code Scan		Kube-bench, Kube-hunter, Kubescape	Scans Kubernetes deployments for security risks, best practices, and compliance checks.

Usage Example:

Trufflehog:

trufflehog filesystem .

Gitleaks:

gitleaks dir backend
gitleaks dir frontend

Troubleshooting and Logs

• DB Build Failure (image issue): Link to Failed Build

• DB Build Success: Link to Successful Build

• Terraform Pipeline (format issue): Link to Issue

• Terraform Lint Failure: Link to Lint Failure

• Terraform Pipeline Success: Link to Success

• Backend Pipeline Success: Link to Backend Success

DevSecOps Details

This project adheres to DevSecOps practices to ensure security is integrated throughout the development lifecycle. Below are some key components:

Security Practices

• Static Application Security Testing (SAST) using GitHub Actions.
• Dynamic Application Security Testing (DAST) to verify the deployed applications.
• Integration of OWASP security scanning.
• Code quality and security scanning using pylint and bandit.
• Implementing container signing with tools like Notary and Sigstore to ensure the integrity of containers.

Automated Pipeline Features

• CI/CD pipeline automatically scans for vulnerabilities at every stage (Dev, QA, Prod).
• Manual approval required for production deployments.
• Slack notifications to update deployment status.

Subfolders Information

Each subfolder contains a README.md file with detailed information on how to run and configure the respective service:

• Terrafrom Folder:

  • Contains instructions for creating Infra for this project.
  • Backend README

• Database Folder:

  • Contains instructions for running the database service.
  • Backend README

• Backend Folder:

  • Contains instructions for running the backend service.
  • Backend README

• Frontend Folder:

  • Contains instructions for setting up and running the frontend.
  • Frontend README

• Deploy Folder:

  • Contains instructions for deploying this application.
  • Backend README

Build

• Successfully genreated kbom file

Trivy

trivy k8s arn:aws:eks:ap-southeast-1:851725219470:cluster/sit-cmts --scanners vuln --skip-check-update --format json -o kbom.json
trivy fs --attest --predicate vuln --output predicate.json kbom.json
trivy fs --skip-update --cache-dir /root/.cache/trivy --format json --output scan-results.json kbom.json

Start server

docker-compose --env-file .env up db