soyouzpanda
2025-07-17 11:34:03 +02:00
parent f6ba3fd878
commit 2a10ee89be
2 changed files with 12 additions and 114 deletions
@@ -1,109 +0,0 @@
From dd7d54e64bbdb853ff60162908f142cb34034cdd Mon Sep 17 00:00:00 2001
From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
Date: Mon, 28 Apr 2025 18:18:39 +0200
Subject: [PATCH 1/2] =?UTF-8?q?=E2=9C=A8(backend)=20support=20`=5FFILE`=20?=
=?UTF-8?q?environment=20variables=20for=20secrets?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Allow configuration variables that handles secrets, like
`DJANGO_SECRET_KEY` to be able to read from a file which is given
through an environment file.
For example, if `DJANGO_SECRET_KEY_FILE` is set to
`/var/lib/docs/django-secret-key`, the value of `DJANGO_SECRET_KEY` will
be the content of `/var/lib/docs/django-secret-key`.
---
src/backend/impress/settings.py | 19 ++++++++++---------
1 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/impress/settings.py b/impress/settings.py
index 571d7052..23c75a98 100755
--- a/impress/settings.py
+++ b/impress/settings.py
@@ -18,6 +18,7 @@ from django.utils.translation import gettext_lazy as _
import sentry_sdk
from configurations import Configuration, values
+from lasuite.configuration.values import SecretFileValue
from sentry_sdk.integrations.django import DjangoIntegration
from sentry_sdk.integrations.logging import ignore_logger
@@ -65,7 +66,7 @@ class Base(Configuration):
# Security
ALLOWED_HOSTS = values.ListValue([])
- SECRET_KEY = values.Value(None)
+ SECRET_KEY = SecretFileValue(None)
SERVER_TO_SERVER_API_TOKENS = values.ListValue([])
# Application definition
@@ -84,7 +85,7 @@ class Base(Configuration):
"impress", environ_name="DB_NAME", environ_prefix=None
),
"USER": values.Value("dinum", environ_name="DB_USER", environ_prefix=None),
- "PASSWORD": values.Value(
+ "PASSWORD": SecretFileValue(
"pass", environ_name="DB_PASSWORD", environ_prefix=None
),
"HOST": values.Value(
@@ -122,10 +123,10 @@ class Base(Configuration):
AWS_S3_ENDPOINT_URL = values.Value(
environ_name="AWS_S3_ENDPOINT_URL", environ_prefix=None
)
- AWS_S3_ACCESS_KEY_ID = values.Value(
+ AWS_S3_ACCESS_KEY_ID = SecretFileValue(
environ_name="AWS_S3_ACCESS_KEY_ID", environ_prefix=None
)
- AWS_S3_SECRET_ACCESS_KEY = values.Value(
+ AWS_S3_SECRET_ACCESS_KEY = SecretFileValue(
environ_name="AWS_S3_SECRET_ACCESS_KEY", environ_prefix=None
)
AWS_S3_REGION_NAME = values.Value(
@@ -384,7 +385,7 @@ class Base(Configuration):
EMAIL_BRAND_NAME = values.Value(None)
EMAIL_HOST = values.Value(None)
EMAIL_HOST_USER = values.Value(None)
- EMAIL_HOST_PASSWORD = values.Value(None)
+ EMAIL_HOST_PASSWORD = SecretFileValue(None)
EMAIL_LOGO_IMG = values.Value(None)
EMAIL_PORT = values.PositiveIntegerValue(None)
EMAIL_USE_TLS = values.BooleanValue(False)
@@ -407,7 +408,7 @@ class Base(Configuration):
COLLABORATION_API_URL = values.Value(
None, environ_name="COLLABORATION_API_URL", environ_prefix=None
)
- COLLABORATION_SERVER_SECRET = values.Value(
+ COLLABORATION_SERVER_SECRET = SecretFileValue(
None, environ_name="COLLABORATION_SERVER_SECRET", environ_prefix=None
)
COLLABORATION_WS_URL = values.Value(
@@ -477,7 +478,7 @@ class Base(Configuration):
OIDC_RP_CLIENT_ID = values.Value(
"impress", environ_name="OIDC_RP_CLIENT_ID", environ_prefix=None
)
- OIDC_RP_CLIENT_SECRET = values.Value(
+ OIDC_RP_CLIENT_SECRET = SecretFileValue(
None,
environ_name="OIDC_RP_CLIENT_SECRET",
environ_prefix=None,
@@ -592,7 +593,7 @@ class Base(Configuration):
AI_FEATURE_ENABLED = values.BooleanValue(
default=False, environ_name="AI_FEATURE_ENABLED", environ_prefix=None
)
- AI_API_KEY = values.Value(None, environ_name="AI_API_KEY", environ_prefix=None)
+ AI_API_KEY = SecretFileValue(None, environ_name="AI_API_KEY", environ_prefix=None)
AI_BASE_URL = values.Value(None, environ_name="AI_BASE_URL", environ_prefix=None)
AI_MODEL = values.Value(None, environ_name="AI_MODEL", environ_prefix=None)
AI_ALLOW_REACH_FROM = values.Value(
@@ -613,7 +614,7 @@ class Base(Configuration):
}
# Y provider microservice
- Y_PROVIDER_API_KEY = values.Value(
+ Y_PROVIDER_API_KEY = SecretFileValue(
environ_name="Y_PROVIDER_API_KEY",
environ_prefix=None,
)
+12 -5
View File
@@ -3,34 +3,40 @@
python3,
fetchFromGitHub,
nixosTests,
fetchPypi,
}:
let
python = python3.override {
self = python3;
packageOverrides = self: super: {
django = super.django_5_2;
django-csp = super.django-csp.overridePythonAttrs rec {
version = "4.0";
src = fetchPypi {
inherit version;
pname = "django_csp";
hash = "sha256-snAQu3Ausgo9rTKReN8rYaK4LTOLcPvcE8OjvShxKDM=";
};
};
};
};
in
python.pkgs.buildPythonApplication rec {
pname = "lasuite-docs";
version = "3.3.0";
version = "3.4.1";
pyproject = true;
src = fetchFromGitHub {
owner = "suitenumerique";
repo = "docs";
tag = "v${version}";
hash = "sha256-SLTNkK578YhsDtVBS4vH0E/rXx+rXZIyXMhqwr95QEA=";
hash = "sha256-QAWwyFp9l+C0XfVu975zjiv61e/S2nYKkUSv4/p7gxw=";
};
sourceRoot = "source/src/backend";
patches = [
# Support for $ENVIRONMENT_VARIABLE_FILE to be able to pass secret files
# See: https://github.com/suitenumerique/docs/pull/912
./environment_variables.patch
# Support configuration throught environment variables for SECURE_*
./secure_settings.patch
];
@@ -45,6 +51,7 @@ python.pkgs.buildPythonApplication rec {
django-configurations
django-cors-headers
django-countries
django-csp
django-extensions
django-filter
django-lasuite