bvandeusen
a7a281cb11
First-party plugins (host_agent, http, snmp, traefik, unifi, docker) are now tracked under plugins/ and baked into the image, so they version atomically with core — ending the cross-repo import drift the roundtable->steward rename exposed. History for these files is preserved in the archived Roundtable-plugins repo. Plugin discovery becomes multi-root: PLUGIN_DIR (single) -> PLUGIN_DIRS (bundled first, then external) + PLUGIN_INSTALL_DIR. Bundled ships in the image; third-party plugins still mount at runtime into the external root (STEWARD_PLUGIN_DIR, default /data/plugins) and downloads/installs land there. Bundled shadows external on a name collision. - config.py: load_bootstrap returns plugin_dirs + plugin_install_dir - app.py: iterate PLUGIN_DIRS at the migration + load sites - migration_runner.py: discover_all_in() unions every plugin root - plugin_manager.py: resolve_plugin_path() (pure, first-root-wins); load / install / hot-reload span all roots; installs target the external root - settings/routes.py: _discover_plugins scans all roots, dedup bundled-first - Dockerfile: COPY plugins/ ; docker-compose: drop host bind, document external - tests/test_plugin_dirs.py: resolution, multi-root discovery, bootstrap split Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
100 lines
3.3 KiB
Python
100 lines
3.3 KiB
Python
# steward/config.py
|
|
from __future__ import annotations
|
|
import logging
|
|
import os
|
|
import secrets
|
|
from pathlib import Path
|
|
from typing import Any
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
_SECRET_KEY_FILE = Path("/data/secret.key")
|
|
|
|
|
|
def _env(suffix: str) -> str | None:
|
|
return os.environ.get(f"STEWARD_{suffix}")
|
|
|
|
|
|
def load_bootstrap(config_path: Path | str | None = None) -> dict[str, Any]:
|
|
"""Return the minimum bootstrap config: database_url and secret_key.
|
|
|
|
This is the only config read from files/env vars at startup.
|
|
Everything else is stored in the app_settings DB table.
|
|
|
|
config_path is optional — used only for backwards compatibility with
|
|
existing config.yaml deployments. The file is not required.
|
|
"""
|
|
from dotenv import load_dotenv
|
|
load_dotenv()
|
|
|
|
raw: dict[str, Any] = {}
|
|
if config_path is None:
|
|
config_path = Path("config.yaml")
|
|
config_path = Path(config_path)
|
|
if config_path.exists():
|
|
import yaml
|
|
with config_path.open() as f:
|
|
raw = yaml.safe_load(f) or {}
|
|
|
|
database_url = (
|
|
_env("DATABASE_URL")
|
|
or _env("DATABASE__URL")
|
|
or raw.get("database", {}).get("url")
|
|
)
|
|
if not database_url:
|
|
raise ValueError(
|
|
"Database URL is required. Set STEWARD_DATABASE_URL env var "
|
|
"or add 'database.url' to config.yaml."
|
|
)
|
|
|
|
secret_key = _resolve_secret_key(raw)
|
|
|
|
# Plugin discovery spans two roots (see load_plugins / migration_runner):
|
|
# • bundled — first-party plugins shipped inside the image at repo-root
|
|
# `plugins/`; they version atomically with core and are read-only at runtime.
|
|
# • external — operator-mounted dir for third-party plugins, persisted in the
|
|
# /data volume. Downloads/installs land here, never in the bundled dir.
|
|
# Bundled is scanned first, so on a name collision the first-party plugin wins.
|
|
bundled_plugin_dir = raw.get("plugin_dir", "plugins")
|
|
external_plugin_dir = (
|
|
_env("PLUGIN_DIR")
|
|
or raw.get("external_plugin_dir")
|
|
or "/data/plugins"
|
|
)
|
|
plugin_dirs = [bundled_plugin_dir]
|
|
if external_plugin_dir and external_plugin_dir != bundled_plugin_dir:
|
|
plugin_dirs.append(external_plugin_dir)
|
|
|
|
return {
|
|
"database_url": database_url,
|
|
"secret_key": secret_key,
|
|
"plugin_dirs": plugin_dirs,
|
|
# Installs/downloads target the external (writable, persistent) dir.
|
|
"plugin_install_dir": external_plugin_dir or bundled_plugin_dir,
|
|
}
|
|
|
|
|
|
def _resolve_secret_key(raw: dict) -> str:
|
|
"""Resolve secret_key: env var → file → auto-generate."""
|
|
from_env = _env("SECRET_KEY") or raw.get("secret_key")
|
|
if from_env:
|
|
return from_env
|
|
|
|
if _SECRET_KEY_FILE.exists():
|
|
key = _SECRET_KEY_FILE.read_text().strip()
|
|
if key:
|
|
return key
|
|
|
|
key = secrets.token_hex(32)
|
|
try:
|
|
_SECRET_KEY_FILE.parent.mkdir(parents=True, exist_ok=True)
|
|
_SECRET_KEY_FILE.write_text(key)
|
|
logger.info("Generated new secret key and saved to %s", _SECRET_KEY_FILE)
|
|
except OSError as exc:
|
|
logger.warning(
|
|
"Could not write secret key to %s (%s). "
|
|
"Key will not persist across restarts.",
|
|
_SECRET_KEY_FILE, exc,
|
|
)
|
|
return key
|