Parham Monfared
1262690276
The single-file stdlib server became the limit: no way to track what had been done about an alert, no accounts, and a UI that had to be hand-rolled in template strings. This restructures it into something deployable. Backend (FastAPI) - app/ holds config, database, auth, delivery and the routers; triagelib keeps the triage engine unchanged, so the validated screening and runbook logic is untouched. - Cases persist per alert fingerprint with a status workflow (investigating, customer contacted, escalated to Infra, waiting, remediated, resolved, won't fix, false positive), an assignee, notes and an append-only history. An alert that stops and re-fires lands back on the same case and counts as a reopen. - Suppression rules move from a JSON file into the database. Auth - Signed session cookies over PBKDF2 local accounts, plus an OIDC flow ready for Authentik: users are created on first login and admin follows a group claim. Local login can be switched off entirely once SSO is live. Zendesk and Jira - Delivery is now implemented, behind three gates: the integration must be configured, its feature flag on, and CX_FEATURE_SEND_ENABLED on. A demo instance leaves the last off and cannot mail anyone. Both search before creating, so re-diagnosing an alert updates one ticket rather than opening several, and a rolling daily cap stops a loop mailing everybody. Deployment - Multi-stage Dockerfile builds the bundle and serves it from the API origin. - docker-compose for local and single-host use; Gitea Actions runs the tests, builds the image and renders deploy/k8s with envsubst. Two fixes found while testing: assigning a case returned a null assignee, and add_event could leave an already-loaded history collection stale. Known gap: the engine reaches OpenStack via `docker exec <region>-osc`, which does not work in a pod without the CX-Tools containers alongside it. docs/DEPLOYMENT.md sets out the three ways to close that. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
102 lines
4.4 KiB
Python
102 lines
4.4 KiB
Python
"""Environment-driven configuration.
|
|
|
|
Everything deployment-specific comes from the environment so the same image runs
|
|
locally under compose and in Kubernetes with only a ConfigMap/Secret difference.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
from functools import lru_cache
|
|
|
|
|
|
def _bool(name: str, default: bool = False) -> bool:
|
|
return str(os.environ.get(name, str(default))).strip().lower() in {"1", "true", "yes", "on"}
|
|
|
|
|
|
def _int(name: str, default: int) -> int:
|
|
try:
|
|
return int(os.environ.get(name, default))
|
|
except (TypeError, ValueError):
|
|
return default
|
|
|
|
|
|
class Settings:
|
|
# --- app ---------------------------------------------------------------
|
|
app_name = os.environ.get("CX_APP_NAME", "CX Triage")
|
|
base_url = os.environ.get("CX_BASE_URL", "http://localhost:8080")
|
|
secret_key = os.environ.get("CX_SECRET_KEY", "dev-only-change-me")
|
|
session_hours = _int("CX_SESSION_HOURS", 12)
|
|
static_dir = os.environ.get("CX_STATIC_DIR", "/app/static")
|
|
|
|
# --- database ----------------------------------------------------------
|
|
# sqlite for local/compose, postgres in the cluster.
|
|
database_url = os.environ.get("CX_DATABASE_URL", "sqlite:////data/cx-triage.db")
|
|
|
|
# --- data sources ------------------------------------------------------
|
|
prometheus_base = os.environ.get("CX_PROMETHEUS_BASE", "http://10.11.254.250:9090")
|
|
prometheus_relay = os.environ.get("CX_PROMETHEUS_RELAY", "")
|
|
cx_tools_path = os.environ.get("CX_TOOLS_PATH", "")
|
|
|
|
# --- auth --------------------------------------------------------------
|
|
# Local accounts are for development and for a cluster without SSO yet.
|
|
# When CX_OIDC_ENABLED is on, Authentik becomes the source of truth.
|
|
auth_local_enabled = _bool("CX_AUTH_LOCAL_ENABLED", True)
|
|
bootstrap_admin_email = os.environ.get("CX_BOOTSTRAP_ADMIN_EMAIL", "admin@localhost")
|
|
bootstrap_admin_password = os.environ.get("CX_BOOTSTRAP_ADMIN_PASSWORD", "")
|
|
|
|
oidc_enabled = _bool("CX_OIDC_ENABLED", False)
|
|
oidc_issuer = os.environ.get("CX_OIDC_ISSUER", "") # e.g. https://sso/application/o/cx-triage/
|
|
oidc_client_id = os.environ.get("CX_OIDC_CLIENT_ID", "")
|
|
oidc_client_secret = os.environ.get("CX_OIDC_CLIENT_SECRET", "")
|
|
oidc_scopes = os.environ.get("CX_OIDC_SCOPES", "openid email profile")
|
|
oidc_admin_group = os.environ.get("CX_OIDC_ADMIN_GROUP", "cx-triage-admins")
|
|
oidc_groups_claim = os.environ.get("CX_OIDC_GROUPS_CLAIM", "groups")
|
|
|
|
# --- feature flags -----------------------------------------------------
|
|
# Sending must be switched on deliberately; a demo instance cannot email.
|
|
feature_send_enabled = _bool("CX_FEATURE_SEND_ENABLED", False)
|
|
feature_zendesk = _bool("CX_FEATURE_ZENDESK", False)
|
|
feature_jira = _bool("CX_FEATURE_JIRA", False)
|
|
feature_linkage_scan = _bool("CX_FEATURE_LINKAGE_SCAN", True)
|
|
send_daily_cap = _int("CX_SEND_DAILY_CAP", 25)
|
|
|
|
# --- integrations ------------------------------------------------------
|
|
zendesk_subdomain = os.environ.get("CX_ZENDESK_SUBDOMAIN", "")
|
|
zendesk_email = os.environ.get("CX_ZENDESK_EMAIL", "")
|
|
zendesk_token = os.environ.get("CX_ZENDESK_TOKEN", "")
|
|
zendesk_default_public = _bool("CX_ZENDESK_PUBLIC_REPLY", True)
|
|
|
|
jira_base = os.environ.get("CX_JIRA_BASE", "")
|
|
jira_email = os.environ.get("CX_JIRA_EMAIL", "")
|
|
jira_token = os.environ.get("CX_JIRA_TOKEN", "")
|
|
jira_project = os.environ.get("CX_JIRA_PROJECT", "INFRA")
|
|
jira_issue_type = os.environ.get("CX_JIRA_ISSUE_TYPE", "Task")
|
|
|
|
@property
|
|
def zendesk_ready(self) -> bool:
|
|
return bool(self.feature_zendesk and self.zendesk_subdomain
|
|
and self.zendesk_email and self.zendesk_token)
|
|
|
|
@property
|
|
def jira_ready(self) -> bool:
|
|
return bool(self.feature_jira and self.jira_base and self.jira_email
|
|
and self.jira_token and self.jira_project)
|
|
|
|
def public_flags(self) -> dict:
|
|
"""What the frontend is allowed to know - never secrets."""
|
|
return {
|
|
"app_name": self.app_name,
|
|
"oidc_enabled": self.oidc_enabled,
|
|
"local_login": self.auth_local_enabled,
|
|
"zendesk_ready": self.zendesk_ready,
|
|
"jira_ready": self.jira_ready,
|
|
"send_enabled": self.feature_send_enabled,
|
|
"linkage_scan": self.feature_linkage_scan,
|
|
"jira_project": self.jira_project if self.jira_ready else "",
|
|
}
|
|
|
|
|
|
@lru_cache
|
|
def get_settings() -> Settings:
|
|
return Settings()
|