New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Refactor: add support for env variables in data migration #1198
Conversation
verifier1 = EligibilityVerifier.objects.create( | ||
name="OAuth claims via Login.gov", | ||
oauth_claims_verifier = EligibilityVerifier.objects.create( | ||
name=os.environ.get("OAUTH_VERIFIER_NAME", "OAuth claims via Login.gov"), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not sure if we consider these names sensitive
short_name="MST (sample)", | ||
long_name="Monterey-Salinas Transit (sample)", | ||
short_name=os.environ.get("MST_AGENCY_SHORT_NAME", "MST (sample)"), | ||
long_name=os.environ.get("MST_AGENCY_LONG_NAME", "Monterey-Salinas Transit (sample)"), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These names don't seem sensitive IMO, but they do vary per environment.
jws_signing_alg="RS256", | ||
jwe_cek_enc=os.environ.get("COURTESY_CARD_VERIFIER_JWE_CEK_ENC", "A256CBC-HS512"), | ||
jwe_encryption_alg=os.environ.get("COURTESY_CARD_VERIFIER_JWE_ENCRYPTION_ALG", "RSA-OAEP"), | ||
jws_signing_alg=os.environ.get("COURTESY_CARD_VERIFIER_JWS_SIGNING_ALG", "RS256"), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we consider these sensitive? I erred on the side of caution here.
I think Kerckhoff's principle would say they are not sensitive (the security of data should not depend on the encryption method remaining a secret).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks good, sets us up to be able to progress towards better management of these items.
I tested locally with the sample data file and it all worked as expected:
- Without any values in my
.env
, every works like before - I was able to override a value via my
.env
Related to #1163
This PR modifies the sample data migration file to look for environment variables for sensitive values, falling back to defaults if an environment variable is not defined.
This is to help move us towards actually using this file for our deployment process. Note that these changes do not break any of the current set up in Azure (since it's not using the sample data) nor does it break local dev environments (no
.env
file required).To test
As an example, you could fill this out to specify real values and add to a
.env
file:Run
and you should then be able to go through the Login.gov flow without changing any of the data migration file.
You can use
unset
(e.g.unset AUTH_PROVIDER_CLIENT_NAME
) to delete an environment variable from your shell.For multi-line values in your .env file, you can wrap them in single quotes, e.g.