mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-11 13:17:07 +00:00
kevinveenbirkenbachandClaude Opus 5.5
167cc22194
A user the host's roles need but the inventory gives no password falls back to a generated password that renders anew on every read, so password converges set values nobody knows (echoserver and galaxyserver stopped at web-app-matomo for that after passing validation). The validator now asks provision's required_user_policies for each host's groups, merges the host's users with Ansible's replace precedence and fails before the deploy, naming the users and the provision command. Presence only: vaulted values count, nothing is decrypted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
68 lines
2.2 KiB
Python
68 lines
2.2 KiB
Python
"""API credential validation: moved credential names and a missing Cloudflare token."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
from utils.cache.api import declared_api
|
|
|
|
from .loaders import merged_variables
|
|
|
|
|
|
def legacy_api_keys(declared: set[str]) -> dict[str, str]:
|
|
"""Map the flat names older inventories gave API credentials to their ``API`` path.
|
|
|
|
Args:
|
|
declared: the variables core reads, see ``read_variables()``.
|
|
|
|
Returns:
|
|
``<PROVIDER>_<KEY>`` in upper case to ``API.<provider>.<key>``, without
|
|
the names core still reads as a variable of their own.
|
|
"""
|
|
legacy = {
|
|
f"{provider}_{key}".upper(): f"API.{provider}.{key}"
|
|
for provider, keys in declared_api().items()
|
|
for key in keys
|
|
}
|
|
return {name: path for name, path in legacy.items() if name not in declared}
|
|
|
|
|
|
def _cloudflare_token(data: dict) -> str:
|
|
api = data.get("API")
|
|
provider = api.get("cloudflare") if isinstance(api, dict) else None
|
|
token = provider.get("api_token") if isinstance(provider, dict) else None
|
|
return str(token or "").strip()
|
|
|
|
|
|
def validate_api_keys(inv_dir) -> list[str]:
|
|
"""Report hosts that select Cloudflare DNS without a Cloudflare token.
|
|
|
|
Args:
|
|
inv_dir: the inventory directory.
|
|
|
|
Returns:
|
|
One message per host whose variables select ``DNS_PROVIDER: cloudflare``
|
|
without ``API.cloudflare.api_token``.
|
|
"""
|
|
root = Path(inv_dir)
|
|
group_all = merged_variables(
|
|
sorted(root.glob("group_vars/all.yml"))
|
|
+ sorted(root.glob("group_vars/all/*.yml"))
|
|
)
|
|
hosts = [(path, [path]) for path in sorted(root.glob("host_vars/*.yml"))]
|
|
hosts += [
|
|
(path, sorted(path.glob("*.yml")))
|
|
for path in sorted(root.glob("host_vars/*"))
|
|
if path.is_dir()
|
|
]
|
|
errs: list[str] = []
|
|
for path, files in hosts or [(root / "group_vars", [])]:
|
|
effective = {**group_all, **merged_variables(files)}
|
|
if effective.get("DNS_PROVIDER") == "cloudflare" and not _cloudflare_token(
|
|
effective
|
|
):
|
|
errs.append(
|
|
f"{path}: DNS_PROVIDER is cloudflare, but API.cloudflare.api_token is empty"
|
|
)
|
|
return errs
|