refactor: replace config.yml with .env for all configuration

All settings (auth credentials, scanner ranges, status_checker interval)
now live in a single .env file via pydantic-settings. config.yml and
config.yml.example are deleted.

- Settings: add auth_username, auth_password_hash, scanner_ranges,
  status_checker_interval; add load_overrides()/save_overrides() for
  persisting runtime changes to data/scan_config.json
- auth.py: read credentials directly from settings
- scan.py: read ranges/interval from settings; write-back via save_overrides()
- scheduler.py: read interval directly from settings
- main.py: call settings.load_overrides() at startup
- docker-compose.yml: remove config.yml volume mount, add new env vars
- conftest.py: set settings fields directly instead of writing a temp config.yml

backend/app/api/routes/auth.py

@@ -1,6 +1,5 @@
 import hmac
 
-import yaml
 from fastapi import APIRouter, HTTPException, status
 from pydantic import BaseModel
 
@@ -20,20 +19,12 @@ class TokenResponse(BaseModel):
     token_type: str = "bearer"
 
 
-def _load_credentials() -> tuple[str, str]:
-    with open(settings.config_path) as f:
-        cfg = yaml.safe_load(f)
-    auth = cfg.get("auth", {})
-    return auth.get("username", "admin"), auth.get("password_hash", "")
-
-
 @router.post("/login", response_model=TokenResponse)
 async def login(body: LoginRequest) -> TokenResponse:
-    username, password_hash = _load_credentials()
     # Always run both checks to prevent timing-based username enumeration.
     # hmac.compare_digest is constant-time; verify_password (bcrypt) always runs.
-    username_ok = hmac.compare_digest(body.username, username)
-    password_ok = verify_password(body.password, password_hash)
+    username_ok = hmac.compare_digest(body.username, settings.auth_username)
+    password_ok = verify_password(body.password, settings.auth_password_hash)
     if not username_ok or not password_ok:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
     token = create_access_token(body.username)

backend/app/api/routes/scan.py

@@ -1,7 +1,6 @@
 import logging
 from typing import Any
 
-import yaml
 from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException
 from pydantic import BaseModel
 from sqlalchemy import select
@@ -20,19 +19,11 @@ class ScanConfig(BaseModel):
     ranges: list[str]
     interval_seconds: int
 
+
 logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
-def _load_ranges() -> list[str]:
-    try:
-        with open(settings.config_path) as f:
-            cfg: dict[str, Any] = yaml.safe_load(f) or {}
-        return list(cfg.get("scanner", {}).get("ranges", []))
-    except Exception:
-        return []
-
-
 async def _background_scan(run_id: str, ranges: list[str]) -> None:
     async with AsyncSessionLocal() as db:
         await run_scan(ranges, db, run_id)
@@ -44,7 +35,7 @@ async def trigger_scan(
     db: AsyncSession = Depends(get_db),
     _: str = Depends(get_current_user),
 ) -> ScanRun:
-    ranges = _load_ranges()
+    ranges = settings.scanner_ranges
     run = ScanRun(status="running", ranges=ranges)
     db.add(run)
     await db.commit()
@@ -112,25 +103,18 @@ async def list_runs(db: AsyncSession = Depends(get_db), _: str = Depends(get_cur
 
 @router.get("/config", response_model=ScanConfig)
 async def get_scan_config(_: str = Depends(get_current_user)) -> ScanConfig:
-    try:
-        with open(settings.config_path) as f:
-            cfg = yaml.safe_load(f)
-        ranges = cfg.get("scanner", {}).get("ranges", [])
-        interval = int(cfg.get("status_checker", {}).get("interval_seconds", 60))
-        return ScanConfig(ranges=ranges, interval_seconds=interval)
-    except Exception as exc:
-        raise HTTPException(status_code=500, detail=str(exc)) from exc
+    return ScanConfig(
+        ranges=settings.scanner_ranges,
+        interval_seconds=settings.status_checker_interval,
+    )
 
 
 @router.post("/config", response_model=ScanConfig)
 async def update_scan_config(payload: ScanConfig, _: str = Depends(get_current_user)) -> ScanConfig:
     try:
-        with open(settings.config_path) as f:
-            cfg = yaml.safe_load(f) or {}
-        cfg.setdefault("scanner", {})["ranges"] = payload.ranges
-        cfg.setdefault("status_checker", {})["interval_seconds"] = payload.interval_seconds
-        with open(settings.config_path, "w") as f:
-            yaml.dump(cfg, f, default_flow_style=False, allow_unicode=True)
+        settings.scanner_ranges = payload.ranges
+        settings.status_checker_interval = payload.interval_seconds
+        settings.save_overrides()
         return payload
     except Exception as exc:
         raise HTTPException(status_code=500, detail=str(exc)) from exc

backend/app/core/config.py

@@ -1,3 +1,6 @@
+import json
+from pathlib import Path
+
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -6,12 +9,43 @@ class Settings(BaseSettings):
 
     secret_key: str  # Required — set SECRET_KEY in .env
     sqlite_path: str = "./data/homelab.db"
-    config_path: str = "./config.yml"
     cors_origins: list[str] = ["http://localhost:5173", "http://localhost:3000"]
 
     # JWT
     algorithm: str = "HS256"
     access_token_expire_minutes: int = 1440  # 24h
 
+    # Auth — set AUTH_USERNAME and AUTH_PASSWORD_HASH in .env
+    auth_username: str = "admin"
+    auth_password_hash: str = ""
 
-settings = Settings()  # type: ignore[call-arg]  # pydantic-settings loads secret_key from env
+    # Scanner
+    scanner_ranges: list[str] = ["192.168.1.0/24"]
+
+    # Status checker
+    status_checker_interval: int = 60
+
+    def _override_path(self) -> Path:
+        return Path(self.sqlite_path).parent / "scan_config.json"
+
+    def load_overrides(self) -> None:
+        """Load runtime scan config overrides written by the API."""
+        try:
+            data = json.loads(self._override_path().read_text())
+            if "scanner_ranges" in data:
+                self.scanner_ranges = data["scanner_ranges"]
+            if "status_checker_interval" in data:
+                self.status_checker_interval = int(data["status_checker_interval"])
+        except Exception:
+            pass
+
+    def save_overrides(self) -> None:
+        """Persist scan config so it survives container restarts."""
+        self._override_path().parent.mkdir(parents=True, exist_ok=True)
+        self._override_path().write_text(json.dumps({
+            "scanner_ranges": self.scanner_ranges,
+            "status_checker_interval": self.status_checker_interval,
+        }))
+
+
+settings = Settings()  # type: ignore[call-arg]

backend/app/core/scheduler.py

@@ -2,7 +2,6 @@
 import logging
 from datetime import UTC, datetime
 
-import yaml
 from apscheduler.schedulers.asyncio import AsyncIOScheduler
 from sqlalchemy import select
 
@@ -46,22 +45,12 @@ async def _run_status_checks() -> None:
             logger.error("Status check failed for node %s: %s", node.id, exc)
 
 
-def _load_interval() -> int:
-    try:
-        with open(settings.config_path) as f:
-            cfg = yaml.safe_load(f)
-        return int(cfg.get("status_checker", {}).get("interval_seconds", 60))
-    except Exception:
-        return 60
-
-
 def start_scheduler() -> None:
     global scheduler
     scheduler = AsyncIOScheduler()
-    interval = _load_interval()
-    scheduler.add_job(_run_status_checks, "interval", seconds=interval, id="status_checks")
+    scheduler.add_job(_run_status_checks, "interval", seconds=settings.status_checker_interval, id="status_checks")
     scheduler.start()
-    logger.info("Scheduler started — status checks every %ds", interval)
+    logger.info("Scheduler started — status checks every %ds", settings.status_checker_interval)
 
 
 def stop_scheduler() -> None:

backend/app/main.py

@@ -14,6 +14,7 @@ from app.db.database import init_db
 @asynccontextmanager
 async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     await init_db()
+    settings.load_overrides()
     start_scheduler()
     yield
     stop_scheduler()