tegwick
0fb7150956
Found by packaging the service for Railiance (rapp-canned-prompts). Every other rapp in the fleet mounts its database credential as a file; this service could only read CANNED_PROMPTS_DATABASE_URL from the environment, which would have put a database password into kubectl describe, into crash dumps, and in reach of anything able to read /proc. Adds CANNED_PROMPTS_DATABASE_URL_FILE and CANNED_PROMPTS_PUBLISH_TOKEN_FILE. A mounted secret stays a file. When both forms are set the file wins, because a rotated secret must take effect rather than be shadowed by a stale env var, and an unreadable secret file fails loudly rather than falling back to a value that may be older. Service tests 33 -> 36. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
63 lines
2.2 KiB
Python
63 lines
2.2 KiB
Python
"""Service configuration.
|
|
|
|
Every value is settable from the environment so the container needs no config
|
|
file. `database_url` has no default on purpose: a service that silently falls
|
|
back to a local database when its real one is misconfigured is worse than one
|
|
that refuses to start.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
model_config = SettingsConfigDict(env_prefix="CANNED_PROMPTS_", extra="ignore")
|
|
|
|
# Two ways in, and the file is the one to use in a cluster: an env var
|
|
# holding a password is visible in `kubectl describe`, in crash dumps, and
|
|
# to anything that can read /proc. The file form lets a mounted secret stay
|
|
# a file.
|
|
database_url: str = ""
|
|
database_url_file: str = ""
|
|
tenant: str = "default"
|
|
service_name: str = "canned-prompts"
|
|
|
|
# A single shared token, so the identity it proves is "the operator of this
|
|
# service" and nothing finer. Unset means the service is read-only; see
|
|
# auth.py for why that is the right default rather than an inconvenience.
|
|
publish_token: str = ""
|
|
publisher_name: str = "operator"
|
|
|
|
publish_token_file: str = ""
|
|
|
|
def _read_secret(self, path: str) -> str:
|
|
try:
|
|
return Path(path).read_text(encoding="utf-8").strip()
|
|
except OSError as exc:
|
|
raise RuntimeError(f"cannot read secret file {path}: {exc}") from exc
|
|
|
|
@property
|
|
def resolved_database_url(self) -> str:
|
|
"""The file wins when both are set: a mounted secret is the stronger
|
|
statement of intent, and silently preferring the env var would make a
|
|
rotated credential look like it had not taken effect."""
|
|
if self.database_url_file:
|
|
return self._read_secret(self.database_url_file)
|
|
return self.database_url
|
|
|
|
@property
|
|
def resolved_publish_token(self) -> str:
|
|
if self.publish_token_file:
|
|
return self._read_secret(self.publish_token_file)
|
|
return self.publish_token
|
|
|
|
@property
|
|
def configured(self) -> bool:
|
|
return bool(self.database_url or self.database_url_file)
|
|
|
|
|
|
def get_settings() -> Settings:
|
|
return Settings()
|