Backblaze / boardwalk

A linear remote execution workflow engine built on top of Ansible
Other
11 stars 0 forks source link

boardwalkd (enh/security): Enable click generation of envvars for options #70

Closed asullivan-blze closed 5 months ago

asullivan-blze commented 5 months ago

What and why?

Specifies context settings for the Click cli.command() for serve in boardwalkd, so that any click.options have environment variables automatically created and checked for values, using the BOARDWALKD prefix.

Tagged as security-related as the key driving factor behind this change was to enable use of the --slack-webhook-url and --slack-error-webhook-url from envvars, because the webhooks URLs are considered secret, and consequently they should not be passed on the command line where they can wind up in the shell history.

Resolves #69. Resolves Backblaze SVRENG-270.

How was this tested?

make test, make develop-server, and boardwalkd serve --develop --host-header-pattern="(localhost|127\.0\.0\.1)" --port=8888 --url='http://localhost:8888' with a testing webhook from https://webhook.site/ set in the environment variables corresponding to the options:

BOARDWALKD_SLACK_ERROR_WEBHOOK_URL=https://webhook.site/f6de29aa-[... truncated ...]
BOARDWALKD_SLACK_WEBHOOK_URL=https://webhook.site/f6de29aa-[... truncated ...]

Status and error messages are correctly sent via boardwalkd and displayed in the web app.

Checklist