utils.manager package

Submodules

utils.manager.credential_key module

The one accepted --set key shape for a credential override.

Both the CLI that parses --set and the inventory manager that consumes the parsed pairs build the key here, so a credential is addressed by exactly one string. A short form would name different credentials on different apps.

utils.manager.credential_key.override_key(app_id: str, key: str) → str

Build the override key for one credential.

Parameters:

  • app_id – application the credential belongs to.

  • key – dotted path inside the schema’s credentials node, e.g. recaptcha.secret.

utils.manager.credential_key.split_override_key(key: str) → tuple[str, str]

Split an override key back into (app_id, credential path).

Parameters:

key – a key in the shape override_key() builds.

utils.manager.inventory module

class utils.manager.inventory.InventoryManager(role_path: Path, inventory_path: Path, vault_pw: str, overrides: dict[str, str], allow_empty_plain: bool = False, variant: int | None = None)

Bases: object

apply_schema() → dict
Apply schema into inventory for:

  1. all recursively discovered shared-provider roles

  2. this role itself

load_application_id(role_path: Path) → str

Load the application ID from the role’s vars/main.yml file.

load_role_config(role_name: str) → dict[str, Any]
load_role_config_by_path(role_path: Path) → dict[str, Any]
load_role_schema(role_name: str) → dict[str, Any]
recurse_credentials(branch: dict, dest: dict, prefix: str = '') → None

Recursively process the ‘credentials’ section and generate values.

Supports the schema:

  • Nested keys are walked transparently (e.g. credentials.recaptcha.{key,secret}).

  • algorithm: defaults to plain when omitted.

  • default: (Jinja literal) is written verbatim and short-circuits algorithm-based generation. validation: is ignored for default-bearing entries.

  • type: and regex: hold an operator-supplied value to the shape the schema declares; a generated one is exempt because the algorithm that produced it is named by the same schema.

  • Existing inventory values are preserved (no double-encryption, no overwrite of operator-supplied secrets).

resolve_schema_includes_recursive(root_role_name: str) → list[str]

Recursively resolve schema includes by following configs transitively.

utils.manager.inventory.validate_supplied_value(full_key: str, value: Any, meta: dict[str, Any]) → None

Hold an operator-supplied credential to the schema it declares.

Only supplied values are checked: a generated one comes from the algorithm the same schema names, and the generators take no schema argument.

Parameters:

  • full_key – dotted schema path, used in the failure message.

  • value – the value the operator supplied, empty meaning “not configured”.

  • meta – the schema leaf, read for type and regex.

Raises:

SystemExit – the value contradicts the declared type or pattern.

Exception: a default: is written into the inventory verbatim, so on the next read it arrives here as if an operator had typed it. Every default in the repository is a Jinja reference, and a pattern describes the rendered secret, not the template text that will produce it.

utils.manager.value_generator module

class utils.manager.value_generator.ValueGenerator

Bases: object

PASSWORD_REGEX = re.compile('^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[^A-Za-z0-9]).{12,}$')
generate_secure_alphanumeric(length: int) → str

Generate a cryptographically secure random alphanumeric string of the given length.

generate_strong_password(length: int = 32) → str
generate_value(algorithm: str) → str

Generate a random secret value according to the specified algorithm.

Supported algorithms: • “random_hex” • “random_hex_32” • “random_hex_16” • “sha256” • “sha1” • “strong_password” • “bcrypt” • “alphanumeric” • “sk_prefixed” • “base64_prefixed_32” • “vapid_private” • “vapid_public” • “rsa_pem_2048”

generate_vapid_keypair() → tuple[str, str]

Return a linked (private, public) VAPID keypair, cached per instance.

Returns:

the P-256 private scalar (32 bytes) and the uncompressed public point (65 bytes, 0x04||X||Y), in the format the Web Push / mastodon ecosystem expects.

Return type:

A tuple of unpadded base64url strings

Module contents