Publish LumaOps source

lumaops/backend/src/lumaops_backend/config.py

@@ -0,0 +1,117 @@
+"""Application configuration with deployment-safe validation."""
+
+from __future__ import annotations
+
+from functools import lru_cache
+from pathlib import Path
+from typing import Literal
+
+from pydantic import Field, field_validator, model_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    """Runtime configuration sourced from environment variables."""
+
+    model_config = SettingsConfigDict(
+        env_file=".env",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+        extra="ignore",
+    )
+
+    app_name: str = "LumaOps"
+    app_version: str = "0.1.0"
+    app_host: str = "0.0.0.0"
+    app_port: int = Field(default=8080, ge=1, le=65535)
+    app_base_url: str = ""
+    environment: Literal["development", "test", "production"] = Field(
+        default="production", alias="LUMAOPS_ENV"
+    )
+    log_level: Literal["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"] = "INFO"
+    timezone: str = Field(default="Europe/Brussels", alias="TZ")
+
+    openrgb_host: str = "127.0.0.1"
+    openrgb_port: int = Field(default=6742, ge=1, le=65535)
+    openrgb_config_dir: Path = Path("/config/openrgb")
+    openrgb_connect_timeout: float = Field(default=2.0, gt=0, le=30)
+    openrgb_command_timeout: float = Field(default=5.0, gt=0, le=60)
+    openrgb_max_packet_size: int = Field(default=16 * 1024 * 1024, ge=1024, le=64 * 1024 * 1024)
+
+    config_dir: Path = Path("/config/lumaops")
+    data_dir: Path = Path("/data")
+    logs_dir: Path = Path("/logs")
+    static_dir: Path = Path("/opt/lumaops/static")
+    database_url: str = "sqlite:////data/lumaops.db"
+    secret_key: str | None = Field(default=None, alias="LUMAOPS_SECRET_KEY")
+
+    enable_network_discovery: bool = True
+    enable_home_assistant: bool = False
+    enable_wled: bool = False
+    connector_mode: Literal["openrgb", "mock"] = "openrgb"
+
+    auth_enabled: bool = True
+    admin_token: str | None = Field(default=None, alias="LUMAOPS_ADMIN_TOKEN")
+    external_access: bool = False
+    trusted_proxies: str = ""
+    cors_origins: str = ""
+    secure_cookies: bool = True
+
+    command_rate_per_second: float = Field(default=10.0, gt=0, le=60)
+    realtime_rate_per_second: float = Field(default=30.0, gt=0, le=120)
+    command_timeout_seconds: float = Field(default=10.0, gt=0, le=120)
+    health_retention_days: int = Field(default=30, ge=1, le=3650)
+
+    @field_validator("openrgb_host")
+    @classmethod
+    def validate_openrgb_host(cls, value: str) -> str:
+        value = value.strip()
+        if not value:
+            raise ValueError("OPENRGB_HOST mag niet leeg zijn")
+        return value
+
+    @model_validator(mode="after")
+    def validate_security_invariants(self) -> Settings:
+        if self.environment == "production" and self.connector_mode == "mock":
+            raise ValueError("MockOpenRGBAdapter is verboden in productie")
+        if self.external_access and not self.auth_enabled:
+            raise ValueError("AUTH_ENABLED is verplicht wanneer EXTERNAL_ACCESS=true")
+        if self.environment == "production" and self.app_host not in {
+            "127.0.0.1",
+            "::1",
+            "localhost",
+        } and not self.auth_enabled:
+            raise ValueError("AUTH_ENABLED is verplicht bij een niet-lokale productiebind")
+        if self.auth_enabled:
+            token = (self.admin_token or "").strip()
+            placeholders = {
+                "replace-with-a-long-random-token",
+                "change-me",
+                "changeme",
+            }
+            if len(token) < 32 or token.lower() in placeholders:
+                raise ValueError(
+                    "LUMAOPS_ADMIN_TOKEN moet minstens 32 tekens lang en niet voorspelbaar zijn"
+                )
+        return self
+
+    @property
+    def database_path(self) -> Path:
+        prefix = "sqlite:///"
+        if not self.database_url.startswith(prefix):
+            raise ValueError("LumaOps MVP ondersteunt uitsluitend sqlite:/// DATABASE_URL waarden")
+        raw = self.database_url[len(prefix) :]
+        return Path(raw if raw else "lumaops.db").expanduser().resolve()
+
+    @property
+    def trusted_proxy_list(self) -> tuple[str, ...]:
+        return tuple(part.strip() for part in self.trusted_proxies.split(",") if part.strip())
+
+    @property
+    def cors_origin_list(self) -> tuple[str, ...]:
+        return tuple(part.strip() for part in self.cors_origins.split(",") if part.strip())
+
+
+@lru_cache(maxsize=1)
+def get_settings() -> Settings:
+    return Settings()