/sidekiq was mounted `unless Rails.env.production?`, and the Docker
image bakes RAILS_ENV=production — so no self-hosted or managed
deployment has ever had queue tooling, while the production basic-auth
block (with default "sure"/"sure" credentials) was dead code. Worse,
any custom non-production env (e.g. staging) got the dashboard with no
authentication at all.
Now:
- Development keeps the open mount for convenience.
- Everywhere else the route only exists for a signed-in super admin,
via a routing constraint that resolves the signed session cookie the
same way Authentication#find_session_by_cookie does. The session's
user is always the true user (impersonation is resolved at the
Current level and impersonating a super admin is forbidden), and
sessions are only created after MFA verification, so neither can
bypass it. Fails closed — errors mean 404.
- The "sure"/"sure" default credentials are deleted. Basic auth now
activates only when BOTH SIDEKIQ_WEB_USERNAME and
SIDEKIQ_WEB_PASSWORD are explicitly set, as an optional second
layer on top of the constraint.
- Documented in .env.example and docs/hosting/docker.md, including
warnings that the dashboard is break-glass tooling: never manually
retry SimplefinConnectionUpdateJob (single-use token), and deleting
jobs does not update the corresponding Sure records.
The super-admin bar's Jobs link is feature-detected via
sidekiq_web_available? and lights up automatically now that the route
exists in production.
