feat: package dark deployment runtime

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

src/sbom_nexus/api.py

@@ -9,12 +9,10 @@ from typing import Any, Literal
 from fastapi import FastAPI, HTTPException, Query, Request
 from pydantic import BaseModel, Field
 
+from sbom_nexus.config import database_target
 from sbom_nexus.scanner import VALID_ECOSYSTEMS, scan_repository
 from sbom_nexus.storage import Store
 
-DEFAULT_DATABASE_TARGET = os.getenv("SBOM_NEXUS_DATABASE_URL") or os.getenv(
-    "SBOM_NEXUS_DATABASE_PATH", "sbom-nexus.db"
-)
 DEFAULT_STALE_DAYS = int(os.getenv("SBOM_NEXUS_STALE_DAYS", "30"))
 
 
@@ -89,7 +87,9 @@ def create_app(database_path: str | Path | None = None) -> FastAPI:
         version="0.1.0",
         description="SBOM capture, history, evaluation, and bounded catch-up service",
     )
-    application.state.store = Store(database_path or DEFAULT_DATABASE_TARGET)
+    application.state.store = Store(
+        database_path if database_path is not None else database_target("sbom-nexus.db")
+    )
     if _auto_create(application.state.store):
         application.state.store.init_schema()
 

src/sbom_nexus/config.py

@@ -0,0 +1,35 @@
+"""Runtime configuration helpers that keep secret values out of manifests."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+
+def database_target(default: str | Path | None = None) -> str | Path:
+    """Return the configured database target, preferring a mounted secret file."""
+    url_file = os.getenv("SBOM_NEXUS_DATABASE_URL_FILE")
+    if url_file:
+        path = Path(url_file)
+        try:
+            value = path.read_text(encoding="utf-8").strip()
+        except OSError as exc:
+            raise RuntimeError(f"Unable to read SBOM_NEXUS_DATABASE_URL_FILE: {path}") from exc
+        if not value:
+            raise RuntimeError(f"SBOM_NEXUS_DATABASE_URL_FILE is empty: {path}")
+        return value
+
+    url = os.getenv("SBOM_NEXUS_DATABASE_URL")
+    if url:
+        return url
+
+    path = os.getenv("SBOM_NEXUS_DATABASE_PATH")
+    if path:
+        return path
+
+    if default is None:
+        raise RuntimeError(
+            "Configure SBOM_NEXUS_DATABASE_URL_FILE, SBOM_NEXUS_DATABASE_URL, "
+            "or SBOM_NEXUS_DATABASE_PATH"
+        )
+    return default