98 lines
2.6 KiB
Go
98 lines
2.6 KiB
Go
package config
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"gopkg.in/yaml.v3"
|
|
)
|
|
|
|
type Config struct {
|
|
Env string `yaml:"env"`
|
|
Port string `yaml:"port"`
|
|
DSN string `yaml:"dsn"`
|
|
StorageDir string `yaml:"storage_dir"`
|
|
MaxUploadBytes int64 `yaml:"max_upload_bytes"`
|
|
AuthSecret string `yaml:"auth_secret"`
|
|
SystemAIKey string `yaml:"system_ai_key"`
|
|
AIKeyEncryptionSecret string `yaml:"ai_key_encryption_secret"`
|
|
AllowedOrigins []string `yaml:"allowed_origins"`
|
|
}
|
|
|
|
func Load() Config {
|
|
cfg, err := LoadFromDir("etc")
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
return cfg
|
|
}
|
|
|
|
func LoadFromDir(configDir string) (Config, error) {
|
|
mode := strings.TrimSpace(os.Getenv("SENLIN_APP_MODE"))
|
|
if mode == "" {
|
|
mode = "dev"
|
|
}
|
|
path := filepath.Join(configDir, "agent."+strings.ToLower(mode)+".yaml")
|
|
data, err := os.ReadFile(path)
|
|
if err != nil {
|
|
return Config{}, err
|
|
}
|
|
var cfg Config
|
|
if err := yaml.Unmarshal(data, &cfg); err != nil {
|
|
return Config{}, err
|
|
}
|
|
if cfg.MaxUploadBytes <= 0 {
|
|
cfg.MaxUploadBytes = 50 << 20
|
|
}
|
|
if strings.TrimSpace(cfg.StorageDir) == "" {
|
|
return Config{}, fmt.Errorf("storage_dir must not be empty")
|
|
}
|
|
hasAllowedOrigin := false
|
|
for _, origin := range cfg.AllowedOrigins {
|
|
if strings.TrimSpace(origin) != "" {
|
|
hasAllowedOrigin = true
|
|
break
|
|
}
|
|
}
|
|
if !hasAllowedOrigin {
|
|
return Config{}, fmt.Errorf("allowed_origins must include at least one origin")
|
|
}
|
|
if err := validateSecret(cfg.Env, "auth_secret", cfg.AuthSecret); err != nil {
|
|
return Config{}, err
|
|
}
|
|
if err := validateSecret(cfg.Env, "ai_key_encryption_secret", cfg.AIKeyEncryptionSecret); err != nil {
|
|
return Config{}, err
|
|
}
|
|
return cfg, nil
|
|
}
|
|
|
|
func validateSecret(environment, field, value string) error {
|
|
secret := strings.TrimSpace(value)
|
|
if secret == "" {
|
|
return fmt.Errorf("%s must not be empty", field)
|
|
}
|
|
if strings.EqualFold(strings.TrimSpace(environment), "production") || strings.EqualFold(strings.TrimSpace(environment), "prod") {
|
|
if len(secret) < 32 || isCommonSecret(secret) {
|
|
return fmt.Errorf("%s must be at least 32 characters and must not use a development sentinel in production", field)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func isCommonSecret(value string) bool {
|
|
normalized := strings.ToLower(strings.TrimSpace(value))
|
|
for _, marker := range []string{"change-me", "changeme", "development", "dev-secret", "local-secret", "test-secret", "placeholder"} {
|
|
if strings.Contains(normalized, marker) {
|
|
return true
|
|
}
|
|
}
|
|
switch normalized {
|
|
case "secret", "password", "default", "admin":
|
|
return true
|
|
default:
|
|
return false
|
|
}
|
|
}
|