tegwick
4b4d556d62
Every live privileged production handler CAS-consumes through approval-engine before OpenBao. Conflict, unavailability, or a missing binding fail closed. Live production remains disabled until the durable decision record is served. Record kings-guard assent on the secret-use evidence contract. Assistant: grok Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
48 lines
1.7 KiB
Python
48 lines
1.7 KiB
Python
"""Runtime configuration resolved from environment and repo layout.
|
|
|
|
Nothing here is a secret. Backend auth (BAO_TOKEN / bootstrap token files) is
|
|
resolved lazily inside the backend adapter, never cached on disk by this module.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
from dataclasses import dataclass
|
|
from pathlib import Path
|
|
|
|
|
|
def repo_root() -> Path:
|
|
"""Repo root = nearest ancestor containing pyproject.toml (fallback: cwd)."""
|
|
here = Path(__file__).resolve()
|
|
for parent in (here, *here.parents):
|
|
if (parent / "pyproject.toml").exists():
|
|
return parent
|
|
return Path.cwd()
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class Config:
|
|
catalog_dir: Path
|
|
policy_dir: Path
|
|
evidence_dir: Path
|
|
hub_url: str
|
|
bao_addr: str
|
|
topic_id: str
|
|
approval_url: str = ""
|
|
approval_token_file: Path | None = None
|
|
|
|
@classmethod
|
|
def load(cls) -> "Config":
|
|
root = repo_root()
|
|
token_file = os.environ.get("SECRETS_ENGINE_APPROVAL_TOKEN_FILE", "")
|
|
return cls(
|
|
catalog_dir=Path(os.environ.get("SECRETS_ENGINE_CATALOG", root / "catalog")),
|
|
policy_dir=Path(os.environ.get("SECRETS_ENGINE_POLICIES", root / "policies")),
|
|
evidence_dir=Path(os.environ.get("SECRETS_ENGINE_EVIDENCE", root / ".evidence")),
|
|
hub_url=os.environ.get("SECRETS_ENGINE_HUB_URL", "http://127.0.0.1:8000"),
|
|
bao_addr=os.environ.get("BAO_ADDR", os.environ.get("VAULT_ADDR", "http://127.0.0.1:8200")),
|
|
topic_id=os.environ.get(
|
|
"SECRETS_ENGINE_TOPIC_ID", "cee7bedf-2b48-46ef-8601-006474f2ad7a"
|
|
),
|
|
approval_url=os.environ.get("SECRETS_ENGINE_APPROVAL_URL", ""),
|
|
approval_token_file=Path(token_file) if token_file else None,
|
|
)
|