fe4cbbe36a
Python control-panel package driving the full provisioning flow from a site's site.yaml (docs/05): - provision: ZFS web dataset + ownership, per-site DB + least-priv user, generated .env encrypted to secrets.enc.yaml (SOPS/age), render the profile templates + persist site.yaml, per-customer chrooted SFTP account, docker compose up. - deprovision (gated: data destroyed only with --purge, after a final backup), backup (ZFS snapshot + mariadb-dump), restore (rollback + import), render (preview), list. Design: one command/file runner with a real --dry-run (prints every action, redacts secrets); idempotent steps; Config + Site validation mirroring docs/03; passwords never logged. Modules: cli, config, naming, context, render, runner, zfs, database, secrets, sftp, compose, provision, backup. Plus pyproject (heleosctl entry point), config.example.yaml, an example site, and a README. Tests: 22 pure-logic unit tests (naming, config validation, template render across all profiles + db on/off) — all passing. Full provision and deprovision verified end-to-end in --dry-run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
39 lines
1.4 KiB
Python
39 lines
1.4 KiB
Python
"""Per-site secret generation + SOPS/age encryption of the .env file."""
|
|
from __future__ import annotations
|
|
|
|
import secrets as _secrets
|
|
from pathlib import Path
|
|
|
|
from .config import Config, Site
|
|
from .runner import Runner
|
|
|
|
|
|
def generate_password(nbytes: int = 24) -> str:
|
|
"""URL-safe token (~32 chars); no shell-special characters."""
|
|
return _secrets.token_urlsafe(nbytes)
|
|
|
|
|
|
def db_env_key(site: Site) -> str:
|
|
return "WORDPRESS_DB_PASSWORD" if site.profile == "wordpress" else "DB_PASSWORD"
|
|
|
|
|
|
def write_env(runner: Runner, out_dir: Path, mapping: dict[str, str]) -> None:
|
|
body = "".join(f"{k}={v}\n" for k, v in mapping.items())
|
|
runner.write_file(out_dir / ".env", body, mode=0o600, secret=True)
|
|
|
|
|
|
def encrypt_env(runner: Runner, cfg: Config, out_dir: Path) -> None:
|
|
"""Encrypt .env → secrets.enc.yaml with SOPS/age (the committed artifact)."""
|
|
if not cfg.sops_age_recipient:
|
|
runner._echo("WARN no sops_age_recipient configured; skipping encryption "
|
|
"(.env is git-ignored but secrets.enc.yaml will not be created)")
|
|
return
|
|
if runner.dry_run:
|
|
runner._echo(f"DRY sops --encrypt {out_dir/'.env'} > {out_dir/'secrets.enc.yaml'}")
|
|
return
|
|
out = runner.run(
|
|
["sops", "--encrypt", "--age", cfg.sops_age_recipient,
|
|
"--input-type", "dotenv", "--output-type", "yaml", str(out_dir / ".env")],
|
|
capture=True,
|
|
)
|
|
runner.write_file(out_dir / "secrets.enc.yaml", out)
|