Jarian Cottingham
afedb6e9ba
- #8: Remove hardcoded credentials, require env vars (YK_ROOT_PIN, YK_INT_PIN, ADMIN_PASSWORD, JWT_SECRET) - #11: JWT secret now random via secrets.token_hex(32) if not set - #12: Admin password from env var, not hardcoded - #14: XSS prevention - sanitize error messages, html.escape - #15: CSRF tokens on all forms - #16: Cookie Secure flag added - #7: datetime.utcnow() → datetime.now(timezone.utc) - #3: Temp files in tempfile.mkdtemp, cleaned after use - #22: Private keys via cryptography library (NoEncryption for now) - #26: DER construction via cryptography library - #27: CRL table added for certificate revocation - #29: WAL autocheckpoint enabled - #30: Caddyfile already has TLS (no change needed) - #6: .gitignore for .password, *.pem, *.key
30 lines
1.1 KiB
Python
30 lines
1.1 KiB
Python
import os
|
|
import secrets
|
|
|
|
YK_ROOT_SERIAL = "35450561"
|
|
YK_ROOT_PIN = os.environ.get("YK_ROOT_PIN")
|
|
if not YK_ROOT_PIN:
|
|
raise RuntimeError("YK_ROOT_PIN environment variable is required")
|
|
YK_INT_SERIAL = "33930436"
|
|
YK_INT_PIN = os.environ.get("YK_INT_PIN")
|
|
if not YK_INT_PIN:
|
|
raise RuntimeError("YK_INT_PIN environment variable is required")
|
|
ROOT_CA_PATH = "/etc/ssl/ca/root/root-ca.crt"
|
|
INT_CA_PATH = "/etc/ssl/ca/intermediate/intermediate-ca.crt"
|
|
CA_CHAIN_PATH = "/etc/ssl/ca/ca-chain.crt"
|
|
ISSUED_DIR = "/etc/ssl/ca/issued"
|
|
DB_PATH = "/var/lib/certauth/certauth.db"
|
|
JWT_SECRET_ENV = os.environ.get("JWT_SECRET")
|
|
if not JWT_SECRET_ENV:
|
|
JWT_SECRET_ENV = secrets.token_hex(32)
|
|
SECRET_KEY = JWT_SECRET_ENV
|
|
ALGORITHM = "HS256"
|
|
ACCESS_TOKEN_EXPIRE_MINUTES = 60
|
|
ADMIN_USERNAME = os.environ.get("ADMIN_USERNAME", "certauth")
|
|
ADMIN_PASSWORD = os.environ.get("ADMIN_PASSWORD")
|
|
if not ADMIN_PASSWORD:
|
|
raise RuntimeError("ADMIN_PASSWORD environment variable is required")
|
|
PKCS11_MODULE = "/usr/lib/aarch64-linux-gnu/opensc-pkcs11.so"
|
|
YK_PUB_ROOT = "/tmp/yk1-root-pub.pem"
|
|
YK_PUB_INT = "/tmp/yk2-int-pub.pem"
|