url/homelable
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: replace config.yml with .env for all configuration

Browse Source 
All settings (auth credentials, scanner ranges, status_checker interval)
now live in a single .env file via pydantic-settings. config.yml and
config.yml.example are deleted.

- Settings: add auth_username, auth_password_hash, scanner_ranges,
  status_checker_interval; add load_overrides()/save_overrides() for
  persisting runtime changes to data/scan_config.json
- auth.py: read credentials directly from settings
- scan.py: read ranges/interval from settings; write-back via save_overrides()
- scheduler.py: read interval directly from settings
- main.py: call settings.load_overrides() at startup
- docker-compose.yml: remove config.yml volume mount, add new env vars
- conftest.py: set settings fields directly instead of writing a temp config.yml
This commit is contained in:
Pouzor
2026-03-09 11:26:49 +01:00
parent acc5bc6a64
commit a56204a5f2
18 changed files with 117 additions and 212 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/.env.example
+11 -1
View File
@@ -1,4 +1,14 @@
SECRET_KEY=<generate with: python3 -c "import secrets; print(secrets.token_urlsafe(32))">
SQLITE_PATH=./data/homelab.db
CONFIG_PATH=./config.yml
CORS_ORIGINS=["http://localhost:5173","http://localhost:3000"]
# Auth — set a strong password hash (generate with passlib):
# python3 -c "from passlib.context import CryptContext; print(CryptContext(schemes=['bcrypt']).hash('yourpassword'))"
AUTH_USERNAME=admin
AUTH_PASSWORD_HASH=
# Scanner — JSON array of CIDR ranges to scan
SCANNER_RANGES=["192.168.1.0/24"]
# Status checker interval in seconds
STATUS_CHECKER_INTERVAL=60
backend/app/api/routes/auth.py
+2 -11
View File
@@ -1,6 +1,5 @@
import hmac
import yaml
from fastapi import APIRouter, HTTPException, status
from pydantic import BaseModel
@@ -20,20 +19,12 @@ class TokenResponse(BaseModel):
token_type: str = "bearer"
def _load_credentials() -> tuple[str, str]:
with open(settings.config_path) as f:
cfg = yaml.safe_load(f)
auth = cfg.get("auth", {})
return auth.get("username", "admin"), auth.get("password_hash", "")
@router.post("/login", response_model=TokenResponse)
async def login(body: LoginRequest) -> TokenResponse:
username, password_hash = _load_credentials()
# Always run both checks to prevent timing-based username enumeration.
# hmac.compare_digest is constant-time; verify_password (bcrypt) always runs.
username_ok = hmac.compare_digest(body.username, username)
password_ok = verify_password(body.password, password_hash)
username_ok = hmac.compare_digest(body.username, settings.auth_username)
password_ok = verify_password(body.password, settings.auth_password_hash)
if not username_ok or not password_ok:
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
token = create_access_token(body.username)
backend/app/api/routes/scan.py
+9 -25
View File
@@ -1,7 +1,6 @@
import logging
from typing import Any
import yaml
from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException
from pydantic import BaseModel
from sqlalchemy import select
@@ -20,19 +19,11 @@ class ScanConfig(BaseModel):
ranges: list[str]
interval_seconds: int
logger = logging.getLogger(__name__)
router = APIRouter()
def _load_ranges() -> list[str]:
try:
with open(settings.config_path) as f:
cfg: dict[str, Any] = yaml.safe_load(f) or {}
return list(cfg.get("scanner", {}).get("ranges", []))
except Exception:
return []
async def _background_scan(run_id: str, ranges: list[str]) -> None:
async with AsyncSessionLocal() as db:
await run_scan(ranges, db, run_id)
@@ -44,7 +35,7 @@ async def trigger_scan(
db: AsyncSession = Depends(get_db),
_: str = Depends(get_current_user),
) -> ScanRun:
ranges = _load_ranges()
ranges = settings.scanner_ranges
run = ScanRun(status="running", ranges=ranges)
db.add(run)
await db.commit()
@@ -112,25 +103,18 @@ async def list_runs(db: AsyncSession = Depends(get_db), _: str = Depends(get_cur
@router.get("/config", response_model=ScanConfig)
async def get_scan_config(_: str = Depends(get_current_user)) -> ScanConfig:
try:
with open(settings.config_path) as f:
cfg = yaml.safe_load(f)
ranges = cfg.get("scanner", {}).get("ranges", [])
interval = int(cfg.get("status_checker", {}).get("interval_seconds", 60))
return ScanConfig(ranges=ranges, interval_seconds=interval)
except Exception as exc:
raise HTTPException(status_code=500, detail=str(exc)) from exc
return ScanConfig(
ranges=settings.scanner_ranges,
interval_seconds=settings.status_checker_interval,
)
@router.post("/config", response_model=ScanConfig)
async def update_scan_config(payload: ScanConfig, _: str = Depends(get_current_user)) -> ScanConfig:
try:
with open(settings.config_path) as f:
cfg = yaml.safe_load(f) or {}
cfg.setdefault("scanner", {})["ranges"] = payload.ranges
cfg.setdefault("status_checker", {})["interval_seconds"] = payload.interval_seconds
with open(settings.config_path, "w") as f:
yaml.dump(cfg, f, default_flow_style=False, allow_unicode=True)
settings.scanner_ranges = payload.ranges
settings.status_checker_interval = payload.interval_seconds
settings.save_overrides()
return payload
except Exception as exc:
raise HTTPException(status_code=500, detail=str(exc)) from exc
backend/app/core/config.py
+36 -2
View File
@@ -1,3 +1,6 @@
import json
from pathlib import Path
from pydantic_settings import BaseSettings, SettingsConfigDict
@@ -6,12 +9,43 @@ class Settings(BaseSettings):
secret_key: str # Required — set SECRET_KEY in .env
sqlite_path: str = "./data/homelab.db"
config_path: str = "./config.yml"
cors_origins: list[str] = ["http://localhost:5173", "http://localhost:3000"]
# JWT
algorithm: str = "HS256"
access_token_expire_minutes: int = 1440 # 24h
# Auth — set AUTH_USERNAME and AUTH_PASSWORD_HASH in .env
auth_username: str = "admin"
auth_password_hash: str = ""
settings = Settings() # type: ignore[call-arg] # pydantic-settings loads secret_key from env
# Scanner
scanner_ranges: list[str] = ["192.168.1.0/24"]
# Status checker
status_checker_interval: int = 60
def _override_path(self) -> Path:
return Path(self.sqlite_path).parent / "scan_config.json"
def load_overrides(self) -> None:
"""Load runtime scan config overrides written by the API."""
try:
data = json.loads(self._override_path().read_text())
if "scanner_ranges" in data:
self.scanner_ranges = data["scanner_ranges"]
if "status_checker_interval" in data:
self.status_checker_interval = int(data["status_checker_interval"])
except Exception:
pass
def save_overrides(self) -> None:
"""Persist scan config so it survives container restarts."""
self._override_path().parent.mkdir(parents=True, exist_ok=True)
self._override_path().write_text(json.dumps({
"scanner_ranges": self.scanner_ranges,
"status_checker_interval": self.status_checker_interval,
}))
settings = Settings() # type: ignore[call-arg]
backend/app/core/scheduler.py
+2 -13
View File
@@ -2,7 +2,6 @@
import logging
from datetime import UTC, datetime
import yaml
from apscheduler.schedulers.asyncio import AsyncIOScheduler
from sqlalchemy import select
@@ -46,22 +45,12 @@ async def _run_status_checks() -> None:
logger.error("Status check failed for node %s: %s", node.id, exc)
def _load_interval() -> int:
try:
with open(settings.config_path) as f:
cfg = yaml.safe_load(f)
return int(cfg.get("status_checker", {}).get("interval_seconds", 60))
except Exception:
return 60
def start_scheduler() -> None:
global scheduler
scheduler = AsyncIOScheduler()
interval = _load_interval()
scheduler.add_job(_run_status_checks, "interval", seconds=interval, id="status_checks")
scheduler.add_job(_run_status_checks, "interval", seconds=settings.status_checker_interval, id="status_checks")
scheduler.start()
logger.info("Scheduler started — status checks every %ds", interval)
logger.info("Scheduler started — status checks every %ds", settings.status_checker_interval)
def stop_scheduler() -> None:
backend/app/main.py
+1
View File
@@ -14,6 +14,7 @@ from app.db.database import init_db
@asynccontextmanager
async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
await init_db()
settings.load_overrides()
start_scheduler()
yield
stop_scheduler()
backend/config.yml.example
-9
View File
@@ -1,9 +0,0 @@
auth:
username: admin
password_hash: "" # Generate with: python -c "from passlib.context import CryptContext; print(CryptContext(schemes=['bcrypt']).hash('yourpassword'))"
scanner:
interval: null
ranges:
- 192.168.1.0/24
status_checker:
interval_seconds: 60
backend/tests/conftest.py
+4 -14
View File
@@ -4,7 +4,6 @@ import os
os.environ.setdefault("SECRET_KEY", "test-only-secret-key-not-for-production")
import pytest
import yaml
from httpx import ASGITransport, AsyncClient
from passlib.context import CryptContext
from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
@@ -18,20 +17,11 @@ _pwd_ctx = CryptContext(schemes=["bcrypt"], deprecated="auto")
@pytest.fixture(autouse=True, scope="session")
def test_config_file(tmp_path_factory):
"""Write a minimal config.yml for the test session and point settings at it."""
cfg = {
"auth": {
"username": "admin",
"password_hash": _pwd_ctx.hash("admin"),
},
"scanner": {"ranges": []},
"status_checker": {"interval_seconds": 3600},
}
cfg_path = tmp_path_factory.mktemp("cfg") / "config.yml"
cfg_path.write_text(yaml.dump(cfg))
def test_credentials():
"""Configure test auth credentials directly on settings."""
from app.core.config import settings
settings.config_path = str(cfg_path)
settings.auth_username = "admin"
settings.auth_password_hash = _pwd_ctx.hash("admin")
@pytest.fixture
backend/tests/test_auth.py
+3 -12
View File
@@ -1,16 +1,7 @@
from unittest.mock import patch
import pytest
from httpx import AsyncClient
@pytest.fixture
def mock_credentials():
with patch("app.api.routes.auth._load_credentials", return_value=("admin", "$2b$12$o/LWyvmBc978CNpSsHxcveXN0WqjAGW/gBR0.U.HURWbaYD3GCDqS")):
yield
async def test_login_success(client: AsyncClient, mock_credentials):
async def test_login_success(client: AsyncClient):
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "admin"})
assert res.status_code == 200
data = res.json()
@@ -18,12 +9,12 @@ async def test_login_success(client: AsyncClient, mock_credentials):
assert data["token_type"] == "bearer"
async def test_login_wrong_password(client: AsyncClient, mock_credentials):
async def test_login_wrong_password(client: AsyncClient):
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "wrong"})
assert res.status_code == 401
async def test_login_wrong_username(client: AsyncClient, mock_credentials):
async def test_login_wrong_username(client: AsyncClient):
res = await client.post("/api/v1/auth/login", json={"username": "notadmin", "password": "admin"})
assert res.status_code == 401
backend/tests/test_canvas.py
+1 -5
View File
@@ -1,16 +1,12 @@
import uuid
from unittest.mock import patch
import pytest
from httpx import AsyncClient
TOKEN_HASH = "$2b$12$o/LWyvmBc978CNpSsHxcveXN0WqjAGW/gBR0.U.HURWbaYD3GCDqS"
@pytest.fixture
async def headers(client: AsyncClient):
with patch("app.api.routes.auth._load_credentials", return_value=("admin", TOKEN_HASH)):
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "admin"})
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "admin"})
return {"Authorization": f"Bearer {res.json()['access_token']}"}
backend/tests/test_edges.py
+1 -6
View File
@@ -1,15 +1,10 @@
from unittest.mock import patch
import pytest
from httpx import AsyncClient
TOKEN_HASH = "$2b$12$o/LWyvmBc978CNpSsHxcveXN0WqjAGW/gBR0.U.HURWbaYD3GCDqS"
@pytest.fixture
async def headers(client: AsyncClient):
with patch("app.api.routes.auth._load_credentials", return_value=("admin", TOKEN_HASH)):
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "admin"})
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "admin"})
token = res.json()["access_token"]
return {"Authorization": f"Bearer {token}"}
backend/tests/test_nodes.py
+1 -6
View File
@@ -1,15 +1,10 @@
from unittest.mock import patch
import pytest
from httpx import AsyncClient
TOKEN_HASH = "$2b$12$o/LWyvmBc978CNpSsHxcveXN0WqjAGW/gBR0.U.HURWbaYD3GCDqS"
@pytest.fixture
async def headers(client: AsyncClient):
with patch("app.api.routes.auth._load_credentials", return_value=("admin", TOKEN_HASH)):
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "admin"})
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "admin"})
token = res.json()["access_token"]
return {"Authorization": f"Bearer {token}"}
backend/tests/test_scan.py
+2 -1
View File
@@ -49,8 +49,9 @@ async def test_trigger_scan_requires_auth(client: AsyncClient):
async def test_trigger_scan_creates_run(client: AsyncClient, headers):
with (
patch("app.api.routes.scan._background_scan", new_callable=AsyncMock),
patch("app.api.routes.scan._load_ranges", return_value=["192.168.1.0/24"]),
patch("app.api.routes.scan.settings") as mock_settings,
):
mock_settings.scanner_ranges = ["192.168.1.0/24"]
res = await client.post("/api/v1/scan/trigger", headers=headers)
assert res.status_code == 200
data = res.json()
backend/tests/test_scheduler.py
+14 -46
View File
@@ -1,11 +1,11 @@
"""Tests for background scheduler: _load_interval, _run_status_checks, lifecycle."""
"""Tests for background scheduler: _run_status_checks, lifecycle."""
import uuid
from unittest.mock import AsyncMock, MagicMock, patch
import pytest
from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
from app.core.scheduler import _load_interval, _run_status_checks, start_scheduler, stop_scheduler
from app.core.scheduler import _run_status_checks, start_scheduler, stop_scheduler
from app.db.database import Base
from app.db.models import Node
@@ -25,35 +25,6 @@ def _make_node(**kwargs) -> Node:
return Node(**{**defaults, **kwargs})
# ---------------------------------------------------------------------------
# _load_interval
# ---------------------------------------------------------------------------
def test_load_interval_reads_from_config(tmp_path):
"""_load_interval returns the value set in config.yml."""
cfg = tmp_path / "config.yml"
cfg.write_text("status_checker:\n interval_seconds: 30\n")
with patch("app.core.scheduler.settings") as mock_settings:
mock_settings.config_path = str(cfg)
assert _load_interval() == 30
def test_load_interval_defaults_to_60_when_key_missing(tmp_path):
"""_load_interval returns 60 when status_checker section is absent."""
cfg = tmp_path / "config.yml"
cfg.write_text("auth:\n username: admin\n")
with patch("app.core.scheduler.settings") as mock_settings:
mock_settings.config_path = str(cfg)
assert _load_interval() == 60
def test_load_interval_defaults_to_60_on_missing_file():
"""_load_interval returns 60 when config file does not exist."""
with patch("app.core.scheduler.settings") as mock_settings:
mock_settings.config_path = "/nonexistent/path/config.yml"
assert _load_interval() == 60
# ---------------------------------------------------------------------------
# _run_status_checks
# ---------------------------------------------------------------------------
@@ -164,26 +135,23 @@ async def test_run_status_checks_handles_check_error_gracefully(mem_db):
# start_scheduler / stop_scheduler
# ---------------------------------------------------------------------------
def test_scheduler_uses_settings_interval():
"""Scheduler registers the job with the interval from settings."""
mock_sched = MagicMock()
with patch("app.core.scheduler.settings") as mock_settings, \
patch("app.core.scheduler.AsyncIOScheduler", return_value=mock_sched):
mock_settings.status_checker_interval = 45
start_scheduler()
_, kwargs = mock_sched.add_job.call_args
assert kwargs["seconds"] == 45
def test_start_and_stop_scheduler():
"""Scheduler can be started and stopped without errors."""
mock_sched = MagicMock()
with patch("app.core.scheduler._load_interval", return_value=3600), \
patch("app.core.scheduler.AsyncIOScheduler", return_value=mock_sched):
with patch("app.core.scheduler.AsyncIOScheduler", return_value=mock_sched):
start_scheduler()
stop_scheduler()
mock_sched.add_job.assert_called_once()
mock_sched.start.assert_called_once()
mock_sched.shutdown.assert_called_once()
def test_start_scheduler_uses_configured_interval():
"""Scheduler registers the status_checks job with the correct interval."""
mock_sched = MagicMock()
with patch("app.core.scheduler._load_interval", return_value=120) as mock_interval, \
patch("app.core.scheduler.AsyncIOScheduler", return_value=mock_sched):
start_scheduler()
mock_interval.assert_called_once()
mock_sched.add_job.assert_called_once()
_, kwargs = mock_sched.add_job.call_args
assert kwargs.get("seconds") == 120
mock_sched.start.assert_called_once()