bvandeusenandClaude Opus 5.5
faa605cead
#5037 "Secrets at rest and in run output: webhook URL and git token encrypted, askpass via env, secret values scrubbed from logs". - webhook.url joins SECRET_KEYS; existing values are sealed at startup by migrate_plaintext_secrets. Settings -> Notifications no longer echoes the URL: it names the saved host, keeps it when left blank, and has a Remove box. - Git source http_token is sealed inside ansible.sources on save and at startup, opened in get_sources, and counted by the undecryptable-secrets scan as ansible.sources[<name>].http_token. - The askpass script holds no token: git runs it with STEWARD_GIT_TOKEN in its environment and printf prints it as data. - The executor masks every secret the run is handed (become/vault passwords, bootstrap passwords, sensitive run vars, and the per-host agent tokens the host_agent plugin now passes as redact) in each line before it is broadcast, logged or stored. - Bundled "Write agent config" tasks are no_log; a test fails if any bundled task templating steward_token lacks it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
85 lines
3.9 KiB
HTML
85 lines
3.9 KiB
HTML
{# steward/templates/settings/notifications.html #}
|
|
{% extends "base.html" %}
|
|
{% from "_macros.html" import crumbs %}
|
|
{% block title %}Settings — Notifications — Steward{% endblock %}
|
|
{% block breadcrumb %}{{ crumbs([("Settings", "/settings/"), ("Notifications", "")]) }}{% endblock %}
|
|
{% block content %}
|
|
{% set active_tab = "notifications" %}
|
|
{% include "settings/_tabs.html" %}
|
|
|
|
<form method="post" action="/settings/notifications/">{{ csrf_field() }}
|
|
<div style="display:grid;gap:1.25rem;max-width:640px;">
|
|
|
|
{# ── SMTP ──────────────────────────────────────────────────────────────── #}
|
|
<div class="card">
|
|
<h2 class="section-title" style="margin-bottom:1.25rem;">Email (SMTP)</h2>
|
|
|
|
<div class="form-group">
|
|
<label>SMTP host</label>
|
|
<input type="text" name="smtp.host" value="{{ settings['smtp.host'] }}"
|
|
placeholder="mail.example.com">
|
|
</div>
|
|
|
|
<div style="display:grid;grid-template-columns:1fr 1fr;gap:1rem;">
|
|
<div class="form-group">
|
|
<label>Port</label>
|
|
<input type="number" name="smtp.port" value="{{ settings['smtp.port'] }}">
|
|
</div>
|
|
<div class="form-group" style="display:flex;align-items:center;gap:0.5rem;padding-top:1.5rem;">
|
|
<input type="checkbox" name="smtp.tls" id="smtp-tls"
|
|
{% if settings['smtp.tls'] %}checked{% endif %}>
|
|
<label for="smtp-tls" style="margin:0;">Use TLS</label>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Username</label>
|
|
<input type="text" name="smtp.username" value="{{ settings['smtp.username'] }}"
|
|
autocomplete="off">
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Password <span style="color:var(--text-muted);font-size:0.8rem;">(leave blank to keep current)</span></label>
|
|
<input type="password" name="smtp.password" placeholder="••••••••" autocomplete="new-password">
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Recipients <span style="color:var(--text-muted);font-size:0.8rem;">(comma-separated)</span></label>
|
|
<input type="text" name="smtp.recipients"
|
|
value="{{ settings['smtp.recipients'] | join(', ') }}"
|
|
placeholder="admin@example.com, ops@example.com">
|
|
</div>
|
|
</div>
|
|
|
|
{# ── Webhook ───────────────────────────────────────────────────────────── #}
|
|
<div class="card">
|
|
<h2 class="section-title" style="margin-bottom:1.25rem;">Webhook</h2>
|
|
|
|
<div class="form-group">
|
|
<label>URL {% if webhook_host %}<span style="color:var(--text-muted);font-size:0.8rem;">(saved for {{ webhook_host }}; leave blank to keep it)</span>{% endif %}</label>
|
|
<input type="password" name="webhook.url" autocomplete="off"
|
|
placeholder="{% if webhook_host %}enter a new URL to replace{% else %}https://discord.com/api/webhooks/...{% endif %}">
|
|
<p style="font-size:0.75rem;color:var(--text-muted);margin-top:0.2rem;">
|
|
Stored encrypted and never shown again: a webhook URL usually holds its own token.</p>
|
|
</div>
|
|
{% if webhook_host %}
|
|
<div class="form-group" style="display:flex;align-items:center;gap:0.5rem;">
|
|
<input type="checkbox" name="webhook.remove" id="webhook-remove">
|
|
<label for="webhook-remove" style="margin:0;">Remove the webhook</label>
|
|
</div>
|
|
{% endif %}
|
|
|
|
<div class="form-group">
|
|
<label>Payload template <span style="color:var(--text-muted);font-size:0.8rem;">(Jinja2, must produce valid JSON)</span></label>
|
|
<textarea name="webhook.template" rows="4"
|
|
style="font-family:ui-monospace,monospace;font-size:0.85rem;">{{ settings['webhook.template'] }}</textarea>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<div style="margin-top:1rem;">
|
|
<button type="submit" class="btn">Save</button>
|
|
</div>
|
|
</form>
|
|
{% endblock %}
|