- Lynis scan failures fixed — binaries were empty (0 bytes) on host, worker container lacked volume mounts
- Lynis wrapper script created at
/usr/local/bin/lynis-agent with timeout, JSON summary, output parsing
- DefectDojo API key updated — old key was invalid; replaced with admin token
b3894c168c17f6cca807525ac38b2f57cfe488cc
- DD_URL updated to
https://security.veripath.co.uk/dojo (was missing /dojo prefix)
- Finding creation fixed — added missing
found_by, numerical_severity, test creation step
- autopush scheduled — completed scans automatically push findings to DefectDojo (VPS Infrastructure product, ID=5)
- Keycloak user attributes — added
org_id=test-client and role=RECEPTIONIST to receptionist-test-client user in test-client realm via API
- Protocol mappers — added
org_id and role attribute mappers on the gp-booking-app OIDC client in the test-client realm
- PartnerOrg activated —
PartnerOrg.is_active set to True for test-client (was False, blocking test-client realm redirect)
- client_secret set to match test-client realm's OIDC secret (
Uue5VoOyk7WtpBuOCbohITAxXRpyO5vo)
- Password reset for
receptionist-test-client in test-client realm to test123
- CrossClientModelBackend — fixed to also search
sector_client alias (was only searching `sector_client_* with trailing underscore)
- tenancy/middleware.py — client-sector PartnerOrgs no longer override tenant to GP parent; the middleware keeps
request.tenant as the client tenant so database routing correctly targets sector_client
- vendor_client (test-client VPS PostgreSQL) — synced 10+ missing columns across
appointments_appointmenttype, appointments_appointment, clinical_data_prescription, users_customuser tables
- Ran full column comparison between default and sector_client — all now in sync
- Migration chain fixed — removed duplicate no-op
0002/0003 stubs in infrastructure/migrations/, --faked clean linear chain
- client_monitor/tasks.py created — Celery tasks for capacity collection, tunnel health checks, and backup monitoring
- Celery Beat schedule added — tunnel health (5min), capacity (1hr), backups (6hr)
¶ Known Remaining Issues
- Security Centre DefectDojo endpoint at
/dojo/api/v2/ returns 502 occasionally (nginx internal IP drift)
- Some client VPS views may still 500 due to schema drift if any columns were missed
client_monitor models aligned but monitoring tasks need VPS tunnel connectivity to functionpatient\_portal app still has dynamic DB alias lookup issues for client tenants