FabledSteward/steward/config.py

# steward/config.py
from __future__ import annotations
import logging
import os
import secrets
from pathlib import Path
from typing import Any

logger = logging.getLogger(__name__)

_SECRET_KEY_FILE = Path("/data/secret.key")


def _env(suffix: str) -> str | None:
    return os.environ.get(f"STEWARD_{suffix}")


def load_bootstrap(config_path: Path | str | None = None) -> dict[str, Any]:
    """Return the minimum bootstrap config: database_url and secret_key.

    This is the only config read from files/env vars at startup.
    Everything else is stored in the app_settings DB table.

    config_path is optional — used only for backwards compatibility with
    existing config.yaml deployments. The file is not required.
    """
    from dotenv import load_dotenv
    load_dotenv()

    raw: dict[str, Any] = {}
    if config_path is None:
        config_path = Path("config.yaml")
    config_path = Path(config_path)
    if config_path.exists():
        import yaml
        with config_path.open() as f:
            raw = yaml.safe_load(f) or {}

    database_url = (
        _env("DATABASE_URL")
        or _env("DATABASE__URL")
        or raw.get("database", {}).get("url")
    )
    if not database_url:
        raise ValueError(
            "Database URL is required. Set STEWARD_DATABASE_URL env var "
            "or add 'database.url' to config.yaml."
        )

    secret_key = _resolve_secret_key(raw)

    db_connect_timeout = _resolve_db_connect_timeout(raw)

    # Plugin discovery spans two roots (see load_plugins / migration_runner):
    #   • bundled  — first-party plugins shipped inside the image at repo-root
    #     `plugins/`; they version atomically with core and are read-only at runtime.
    #   • external — operator-mounted dir for third-party plugins, persisted in the
    #     /data volume. Downloads/installs land here, never in the bundled dir.
    # Bundled is scanned first, so on a name collision the first-party plugin wins.
    bundled_plugin_dir = raw.get("plugin_dir", "plugins")
    external_plugin_dir = (
        _env("PLUGIN_DIR")
        or raw.get("external_plugin_dir")
        or "/data/plugins"
    )
    plugin_dirs = [bundled_plugin_dir]
    if external_plugin_dir and external_plugin_dir != bundled_plugin_dir:
        plugin_dirs.append(external_plugin_dir)

    return {
        "database_url": database_url,
        "secret_key": secret_key,
        "db_connect_timeout": db_connect_timeout,
        "plugin_dirs": plugin_dirs,
        # Installs/downloads target the external (writable, persistent) dir.
        "plugin_install_dir": external_plugin_dir or bundled_plugin_dir,
    }


def _resolve_db_connect_timeout(raw: dict) -> float:
    """How long to wait for the database at startup, in seconds.

    Bootstrap-only by necessity: this governs reaching the DB, so it cannot
    itself be read from the DB like the rest of Steward's settings.

    A deployment whose database is slower to come up than the default (a large
    cluster replaying WAL, a remote DB behind a link that takes a while) can
    raise it rather than crash-looping the container.
    """
    from .database import DB_CONNECT_TIMEOUT_SECONDS

    value = _env("DB_CONNECT_TIMEOUT") or raw.get("database", {}).get("connect_timeout")
    if value is None or value == "":
        return DB_CONNECT_TIMEOUT_SECONDS
    try:
        parsed = float(value)
    except (TypeError, ValueError):
        logger.warning(
            "Invalid database connect timeout %r — using default %.0fs",
            value, DB_CONNECT_TIMEOUT_SECONDS,
        )
        return DB_CONNECT_TIMEOUT_SECONDS
    if parsed <= 0:
        # 0/negative would mean "never wait", which is the broken behaviour this
        # setting exists to fix — treat it as a mistake, not as an opt-out.
        logger.warning(
            "Database connect timeout %.0fs is not positive — using default %.0fs",
            parsed, DB_CONNECT_TIMEOUT_SECONDS,
        )
        return DB_CONNECT_TIMEOUT_SECONDS
    return parsed


def _resolve_secret_key(raw: dict) -> str:
    """Resolve secret_key: env var → file → auto-generate.

    Refuses to start if a new key must be generated but cannot be persisted: an
    ephemeral key changes on every restart, which silently renders every
    encrypted secret (managed SSH key, SMTP/OIDC/LDAP credentials) unrecoverable.
    Failing loudly with a fix beats limping along and losing data on the next
    boot — exactly the footgun that bit the vdnt-docker02 deployment.
    """
    from_env = _env("SECRET_KEY") or raw.get("secret_key")
    if from_env:
        return from_env

    if _SECRET_KEY_FILE.exists():
        try:
            key = _SECRET_KEY_FILE.read_text().strip()
        except OSError as exc:
            raise RuntimeError(
                f"App secret key file {_SECRET_KEY_FILE} exists but cannot be read "
                f"({exc}). Make it readable by the container user (uid 1000), or set "
                f"STEWARD_SECRET_KEY."
            ) from exc
        if key:
            return key

    key = secrets.token_hex(32)
    try:
        _SECRET_KEY_FILE.parent.mkdir(parents=True, exist_ok=True)
        _SECRET_KEY_FILE.write_text(key)
    except OSError as exc:
        raise RuntimeError(
            f"Generated a new app secret key but could not persist it to "
            f"{_SECRET_KEY_FILE} ({exc}). An ephemeral key changes on every restart, "
            f"which makes all encrypted secrets (managed SSH key, SMTP/OIDC/LDAP "
            f"credentials) unrecoverable. Fix one of:\n"
            f"  • set STEWARD_SECRET_KEY to a stable value "
            f"(recommended for Swarm / multi-node), or\n"
            f"  • make {_SECRET_KEY_FILE.parent} writable by the container user "
            f"(uid 1000)."
        ) from exc
    logger.info("Generated new secret key and saved to %s", _SECRET_KEY_FILE)
    return key