FabledSteward

bvandeusen/FabledSteward

Fork 0

Files

T

History

bvandeusen 6e91bdc82b

CI / lint (push) Successful in 2s

Details

CI / unit (push) Successful in 7s

Details

CI / integration (push) Successful in 2m17s

Details

CI / publish (push) Successful in 45s

Details

feat(security): encrypt sensitive settings at rest (Fernet)

Secrets (smtp.password, oidc.client_secret, ldap.bind_password, ansible
ssh_private_key/become_password/vault_password) were stored plaintext in
app_settings. Add transparent encryption-at-rest:

- steward/core/crypto.py: Fernet keyed off the app secret (/data/secret.key),
  enc:v1: prefix marks ciphertext; passthrough for plaintext/empty/no-key,
  never reveals plaintext on a wrong key.
- settings.py: SECRET_KEYS registry; set_setting encrypts on write; all read
  paths (get_setting / get_all_settings / load_settings_sync) decrypt
  transparently; migrate_plaintext_secrets() converts legacy rows in place.
- app.py startup: init_crypto(SECRET_KEY) + one-time legacy-secret migration
  before settings load.
- Add cryptography dependency.

UI masking is unchanged (it checks decrypted truthiness). Key-loss caveat
documented: secrets are unrecoverable if the app secret key is lost. Unit
tests cover round-trip, empty/plaintext passthrough, and wrong-key safety.

Task #580.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-16 15:22:43 -04:00

alerts

feat(alerts): run an Ansible playbook on alert firing (task 250)

2026-06-02 14:22:29 -04:00

ansible

feat(ansible): runner robustness — cancel, concurrency, structured results, retention

2026-06-16 14:51:04 -04:00

audit

chore: rename project Roundtable → Steward

2026-04-25 16:20:14 -04:00

auth

feat(plugins): plugin capability registry + host_agent→Ansible deploy synergy