vitor-aignosi
ecb055eefb
SIENTIAPDE-1973: Implement per-connector OPC client certificates and remove legacy read engine. This update overhauls certificate management, transitioning from a single platform certificate to individual client certificates defined in the slot configuration. The CertProvider now downloads certificates from MinIO based on certificate_id, applying dynamic security policies (mode, policy) from the slot. The legacy READ_ENGINE=legacy option and OpcManager have been entirely removed, standardizing on the ServerReader with strict slot v2 enforcement. Write command resolution (ServerConfigResolver) now consistently uses connectors joined with opc_certificates. The CERT_BUCKET environment variable is no longer used.
54 lines
2.2 KiB
Python
54 lines
2.2 KiB
Python
"""Gateway-specific env config (NATS/gRPC/certs/write flags).
|
|
|
|
Separate from ingestor.py's inline os.getenv (Redis/Mongo/TTLs) — this module
|
|
covers only the new gateway wiring consumed by app.py in Task 18.
|
|
"""
|
|
|
|
from dataclasses import dataclass
|
|
from os import getenv
|
|
|
|
|
|
def _env_bool(name: str, default: bool) -> bool:
|
|
value = getenv(name)
|
|
if value is None:
|
|
return default
|
|
return value.strip().lower() in ('true', '1', 'yes')
|
|
|
|
|
|
@dataclass
|
|
class GatewayConfig:
|
|
nats_url: str = 'nats://localhost:4222'
|
|
nats_write_subject: str = 'opc.write'
|
|
nats_queue: str = 'gateway-writers'
|
|
grpc_enabled: bool = False
|
|
grpc_port: int = 50051
|
|
# The certificate bucket and objects come from the slot / the write lookup
|
|
# (opc_certificates, SIENTIAPDE-1974); only the local cache dir is configured here.
|
|
cert_cache_dir: str = '/tmp/opc-certs' # noqa: S108 # nosec B108 - default is spec'd, overridable via env
|
|
write_timestamp: bool = True
|
|
write_quality: bool = True
|
|
write_min_pause_s: float = 0.0
|
|
idle_conn_max_s: float = 300.0
|
|
|
|
@classmethod
|
|
def certs_from_env(cls) -> 'GatewayConfig':
|
|
"""Only the certificate settings — what the read path needs. Plain strings,
|
|
no number parsing, so a malformed write/gRPC env var (GRPC_PORT,
|
|
WRITE_MIN_PAUSE_S, ...) can only disable the runtime, never the reads."""
|
|
return cls(cert_cache_dir=getenv('CERT_CACHE_DIR', cls.cert_cache_dir))
|
|
|
|
@classmethod
|
|
def from_env(cls) -> 'GatewayConfig':
|
|
return cls(
|
|
nats_url=getenv('NATS_URL', cls.nats_url),
|
|
nats_write_subject=getenv('NATS_WRITE_SUBJECT', cls.nats_write_subject),
|
|
nats_queue=getenv('NATS_QUEUE', cls.nats_queue),
|
|
grpc_enabled=_env_bool('GRPC_ENABLED', cls.grpc_enabled),
|
|
grpc_port=int(getenv('GRPC_PORT', cls.grpc_port)),
|
|
cert_cache_dir=getenv('CERT_CACHE_DIR', cls.cert_cache_dir),
|
|
write_timestamp=_env_bool('WRITE_TIMESTAMP', cls.write_timestamp),
|
|
write_quality=_env_bool('WRITE_QUALITY', cls.write_quality),
|
|
write_min_pause_s=float(getenv('WRITE_MIN_PAUSE_S', cls.write_min_pause_s)),
|
|
idle_conn_max_s=float(getenv('IDLE_CONN_MAX_S', cls.idle_conn_max_s)),
|
|
)
|