takunomi-build-bot
166dfcc9f3
This commit was automatically generated by a script: https://gitfub.space/Jmaa/repo-manager
94 lines
3.7 KiB
Markdown
94 lines
3.7 KiB
Markdown
<!--- WARNING --->
|
|
<!--- THIS IS AN AUTO-GENERATED FILE --->
|
|
<!--- MANUAL CHANGES CAN AND WILL BE OVERWRITTEN --->
|
|
|
|
|
|
|
|
# Secret Loader System
|
|
|
|
 
|
|
|
|
System for loading secrets from a variety of sources.
|
|
|
|
Usage:
|
|
|
|
```python
|
|
import secret_loader
|
|
|
|
secrets = secret_loader.SecretLoader(env_key_prefix='MYAPP')
|
|
|
|
db_username = secrets.load_or_fail('DATABASE_USERNAME')
|
|
db_password = secrets.load_or_fail('DATABASE_PASSWORD')
|
|
```
|
|
|
|
Secret loading order:
|
|
|
|
0. Hardcoded values. **This is purely for debugging, prototyping, and for
|
|
configuring below options.**
|
|
1. Files pointed to by environment variables. Docker friendly.
|
|
2. Secrets folder. Also Docker friendly. Defaults to `secrets`, but can be
|
|
configured through the `SECRETS_DIRECTORY` key (NOTE: passed directly,
|
|
rather than through a file.)
|
|
3. [Pass: the standard unix password
|
|
manager](https://www.passwordstore.org/). Most suited for personal
|
|
usage; very unsuited for server environments. Requires `pass` installed
|
|
locally, and configuration of the `PASS_STORE_SUBFOLDER` through one of the above
|
|
methods.
|
|
|
|
## Future extensions
|
|
|
|
- [ ] Key casing should be more consistent
|
|
* Case-insensitive for hardcoded and `load`.
|
|
* Upper case for environment variables.
|
|
* Lower case for files and others.
|
|
- [ ] New special configuration value for switching the `secrets` directory.
|
|
- [ ] Wrap secrets in intelligent strings:
|
|
* [ ] Instead of returning `None` on unloaded, return `UnknownSecret`, that produce error when formatted.
|
|
* [ ] `repr(secret)` should not include contents, but only the secret and how it was loaded.
|
|
* [ ] Methods on `Secret` should be kept minimal.
|
|
- [ ] Avoid leakage to swap files.
|
|
* Possibly Mlock? [Does not seem to work](https://stackoverflow.com/questions/29524020/prevent-ram-from-paging-to-swap-area-mlock)
|
|
* Alternatively use [mmap](https://docs.python.org/3/library/mmap.html) and [memoryview](https://stackoverflow.com/questions/18655648/what-exactly-is-the-point-of-memoryview-in-python)?§
|
|
- [ ] Vault:
|
|
* [ ] Ensure vault code path works.
|
|
* [ ] Document usage and requirements.
|
|
- [ ] Get inspiration from <https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html>
|
|
|
|
## Dependencies
|
|
|
|
All requirements can be installed easily using:
|
|
|
|
```bash
|
|
pip install -r requirements.txt
|
|
```
|
|
|
|
Full list of requirements:
|
|
- [frozendict](https://pypi.org/project/frozendict/)
|
|
|
|
|
|
## License
|
|
|
|
```
|
|
MIT License
|
|
|
|
Copyright (c) 2024 Jon Michael Aanes
|
|
|
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
of this software and associated documentation files (the "Software"), to deal
|
|
in the Software without restriction, including without limitation the rights
|
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
copies of the Software, and to permit persons to whom the Software is
|
|
furnished to do so, subject to the following conditions:
|
|
|
|
The above copyright notice and this permission notice shall be included in all
|
|
copies or substantial portions of the Software.
|
|
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
SOFTWARE.
|
|
```
|