Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue 967: Dynamically generate DJANGO_SECRET_KEY for initial deployments #1151

Merged
merged 7 commits into from
Aug 5, 2021
Merged

Issue 967: Dynamically generate DJANGO_SECRET_KEY for initial deployments #1151

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
2110129
Dynamically generate DJANGO_SECRET_KEY for initial deployments
jtwillis92 Jul 27, 2021
dc9a6a0
Remove unneeded DJANGO_SECRET_KEY declaration in docker-compose.yml
jtwillis92 Jul 27, 2021
b22b391
Merge branch 'raft-tdp-main' into devops/967-django-secret-key-genera…
jtwillis92 Jul 28, 2021
705cd51
Merge branch 'raft-tdp-main' into devops/967-django-secret-key-genera…
jtwillis92 Jul 29, 2021
437339c
Merge branch 'raft-tdp-main' into devops/967-django-secret-key-genera…
jtwillis92 Jul 29, 2021
2d41b2c
Prevent parse error on nested JSON
jtwillis92 Aug 2, 2021
30c57ef
Merge branch 'raft-tdp-main' into devops/967-django-secret-key-genera…
jtwillis92 Aug 2, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions scripts/copy-login-gov-keypair.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
#!/usr/bin/env bash
###
# Copies Login.gov JWT_KEY + JWT_CERT from one Cloud.gov application to another.
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is simply a convenience script for developers, it is not called by any other methods. This is something I've had in my scratch files for awhile and have been using it to restore Login.gov credentials back to an application that has been deleted and re-created. Otherwise we would have to update the certificate in Login.gov and pass out the newly generated key to developers. Note that this does not replace the JWT rotation documentation, this is only suitable when it is desired to keep the current Login.gov keypair.

#
SOURCE_APP=${1}
DEST_APP=${2}

set -e

SOURCE_APP_GUID=$(cf app "$SOURCE_APP" --guid)
SOURCE_APP_ENV=$(cf curl "/v2/apps/$SOURCE_APP_GUID/env")
ENVIRONMENT_JSON=$(printf '%s\n' "$SOURCE_APP_ENV" | jq -r '.environment_json')

JWT_KEY=$(echo "$ENVIRONMENT_JSON" | jq -r '.JWT_KEY')
JWT_CERT=$(echo "$ENVIRONMENT_JSON" | jq -r '.JWT_CERT')

echo "JWT_KEY: $JWT_KEY"
echo "JWT_CERT: $JWT_CERT"

if [ -n "$DEST_APP" ];then
echo "Copying JWT key and cert from $SOURCE_APP to $DEST_APP..."
cf set-env "$DEST_APP" JWT_KEY "$JWT_KEY"
cf set-env "$DEST_APP" JWT_CERT "$JWT_CERT"

echo "Restaging $DEST_APP..."
cf restage "$DEST_APP"
fi
3 changes: 3 additions & 0 deletions scripts/set-backend-env-vars.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,9 @@ else
FRONTEND_BASE_URL="$DEFAULT_FRONTEND_ROUTE"
fi

# Dynamically generate a new DJANGO_SECRET_KEY
DJANGO_SECRET_KEY=$(python -c "from secrets import token_urlsafe; print(token_urlsafe(50))")
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the key change, setting this here will overwrite what is stored in Circle CI for this variable (if anything). Uses the new (as of Python 3.6) secrets module in the standard library.


echo "Setting environment variables for $CGAPPNAME_BACKEND"

cf set-env "$CGAPPNAME_BACKEND" ACR_VALUES "$ACR_VALUES"
Expand Down
1 change: 0 additions & 1 deletion tdrs-backend/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,6 @@ services:
web:
restart: always
environment:
- DJANGO_SECRET_KEY=local
- DB_USER=tdpuser
- DB_PASSWORD=something_secure
- DB_NAME=tdrs_test
Expand Down
3 changes: 2 additions & 1 deletion tdrs-backend/tdpservice/settings/common.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
import os
from distutils.util import strtobool
from os.path import join
from secrets import token_urlsafe

from configurations import Configuration

Expand Down Expand Up @@ -106,7 +107,7 @@ class Common(Configuration):

ALLOWED_HOSTS = ["*"]
ROOT_URLCONF = "tdpservice.urls"
SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]
SECRET_KEY = os.getenv("DJANGO_SECRET_KEY", token_urlsafe(50))
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By supplying a default here we prevent a possible KeyError when that environment variable is not set and instead use a secure, newly generated value. This also allows us to remove this variable declaration from the docker-compose.yml and Circle CI project settings.

WSGI_APPLICATION = "tdpservice.wsgi.application"
CORS_ORIGIN_ALLOW_ALL = True

Expand Down