CCD-7877 Remove hardcoded local SSL private key

.gitignore

@@ -63,3 +63,4 @@ yarn-audit-issues
 !.yarn/releases
 !.yarn/sdks
 !.yarn/versions
+app/resources/localhost-ssl/*.key

README.md

@@ -47,6 +47,10 @@ The following environment variables are required:
 | ADDRESS_LOOKUP_TOKEN | Token for use with the MoJ Address Lookup service. |
 | CORS_ORIGIN_WHITELIST | Comma-separated list of authorised origins for Cross-Origin requests. `http://localhost:3451,http://localhost:3452` for the local instances of CCD |
 | APPINSIGHTS_INSTRUMENTATIONKEY | Secret for Microsoft Insights logging, can be a dummy string in local. |
+| HTTPS_CERT_PATH | Optional path to a locally generated HTTPS certificate. Used with `HTTPS_KEY_PATH` when `ENV=localdev`. |
+| HTTPS_KEY_PATH | Optional path to the matching locally generated HTTPS private key. Never commit the key to the repository. |
+
+For local development, the gateway uses HTTP by default. To enable HTTPS, set `ENV=localdev` and provide both `HTTPS_CERT_PATH` and `HTTPS_KEY_PATH` pointing to files generated outside the repository. Both variables must be set together.
 
 **Note:** To support large document uploads via the api gateway, the maximum allowed length for request content is 
 configured via *maxAllowedContentLength* property for request filter in **web.config** (config file within source repository). 

docs/skills/CCD_7877_Hardcoded_Credentials/SKILL.md

@@ -0,0 +1,40 @@
+# CCD-7877 Hardcoded Credentials
+
+## Objective
+
+Remove the tracked private key and externalise runtime credentials while preserving safe local development.
+
+## Acceptance criteria
+
+- No private key is tracked.
+- Runtime credentials use environment or managed-secret injection.
+- Local HTTPS uses ignored, locally managed certificate files.
+- No live credential rotation is performed by this change.
+
+## Validation
+
+- Node syntax and Compose interpolation checks passed.
+- Full Docker runtime validation remains outstanding.
+
+## Scope and findings
+
+Remediation status: the tracked key has now been removed from this branch. Local HTTPS uses `HTTPS_CERT_PATH` and `HTTPS_KEY_PATH`; no live credential rotation was performed.
+
+- `app/resources/localhost-ssl/localhost.key` is a tracked PEM RSA private key, added in history on 2018-03-17 during open sourcing.
+- `server.js` reads externally supplied certificate and key paths for local HTTPS; it no longer reads bundled key material.
+- Existing secret-to-environment mappings include `IDAM_OAUTH2_CLIENT_SECRET`, `ADDRESS_LOOKUP_TOKEN`, `IDAM_SERVICE_KEY`, and `APPINSIGHTS_INSTRUMENTATIONKEY`.
+- Prior history includes secret-removal work, but not evidence of private-key rotation.
+
+## Validity and deployment
+
+- Current validity: **not confirmed**; no live authentication or secret-store access was available.
+- Deployment/runtime: repository evidence only; Helm/Terraform and environment-backed configuration exist, but live pods, CI variables, and cloud secret stores were not accessible.
+- Rotation: **not confirmed** for the key or reported credentials.
+
+## Recommendations
+
+Treat the key and reported credentials as compromised. Revoke/rotate through the owning systems, remove the key from source and history, and use runtime-mounted secrets or managed TLS. Continue using the existing environment variables; if a runtime key is required, use `HTTPS_KEY_PATH` and `HTTPS_CERT_PATH`. Verify live secret-store references, deployed pods, CI/CD variables, and rotation records before closure.
+
+## Local operation
+
+Local HTTPS is now externalised. When running standalone, provide `HTTPS_CERT_PATH` and `HTTPS_KEY_PATH` to locally managed files. When using the CCD Docker stack, run `ccd-docker/bin/setup-local-secrets.sh`; it creates ignored local values and certificate files for the stack. No approved fixed-defaults-file fallback is currently implemented.

server.js

@@ -9,7 +9,6 @@ let app = require('./app');
 let debug = require('debug')('ccd-api-gateway-web:server');
 let http = require('http');
 let https = require('https');
-let path = require('path');
 let fs = require('fs');
 
 /**
@@ -28,10 +27,17 @@ let server = createServer(app);
 
 function createServer(app) {
   if (process.env.ENV === 'localdev') {
-    const sslDirectory = path.join(__dirname, '..', 'app', 'resources', 'localhost-ssl');
+    const certificatePath = process.env.HTTPS_CERT_PATH;
+    const keyPath = process.env.HTTPS_KEY_PATH;
+    if (!certificatePath && !keyPath) {
+      return http.createServer(app);
+    }
+    if (!certificatePath || !keyPath) {
+      throw new Error('HTTPS_CERT_PATH and HTTPS_KEY_PATH must both be set for local HTTPS');
+    }
     const sslOptions = {
-      cert: fs.readFileSync(path.join(sslDirectory, 'localhost.crt')),
-      key: fs.readFileSync(path.join(sslDirectory, 'localhost.key')),
+      cert: fs.readFileSync(certificatePath),
+      key: fs.readFileSync(keyPath),
       secureProtocol: 'TLS_method'
     };
     return https.createServer(sslOptions, app);