{"action":"created","comment":{"url":"https://api.github.com/repos/open-craft/opencraft/pulls/comments/85421781","pull_request_review_id":6140355,"id":85421781,"diff_hunk":"@@ -0,0 +1,105 @@\n+# -*- coding: utf-8 -*-\n+#\n+# OpenCraft -- tools to aid developing and hosting free software projects\n+# Copyright (C) 2015-2016 OpenCraft <contact@opencraft.com>\n+#\n+# This program is free software: you can redistribute it and/or modify\n+# it under the terms of the GNU Affero General Public License as\n+# published by the Free Software Foundation, either version 3 of the\n+# License, or (at your option) any later version.\n+#\n+# This program is distributed in the hope that it will be useful,\n+# but WITHOUT ANY WARRANTY; without even the implied warranty of\n+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n+# GNU Affero General Public License for more details.\n+#\n+# You should have received a copy of the GNU Affero General Public License\n+# along with this program.  If not, see <http://www.gnu.org/licenses/>.\n+#\n+\"\"\"\n+Instance app model mixins - Database\n+\"\"\"\n+\n+# Imports #####################################################################\n+\n+import os\n+import hashlib\n+import hmac\n+from base64 import b64encode, b64decode\n+\n+from django.db import models\n+from django.template import loader\n+\n+# Functions ###################################################################\n+\n+\n+def generate_secret_key(char_length):\n+    \"\"\"\n+    Creates a base64-encoded string of character length `char_length`\n+    for use in other functions.\n+    \"\"\"\n+    if char_length <= 0 or char_length % 4:\n+        # b64encode will always pad its output to four characters, regardless\n+        # of the byte count. We'd rather error out than encode too few or too many.\n+        raise ValueError('char_length must be a positive multiple of 4')\n+    # We need three random bytes per four random b64 characters.\n+    random_bytes = os.urandom(int(char_length * 0.75))\n+    # Encode to a b64 string...\n+    random_string = b64encode(random_bytes)\n+    # ...and return!\n+    return random_string\n+\n+\n+# Classes #####################################################################\n+\n+class SecretKeyInstanceMixin(models.Model):\n+    \"\"\"\n+    An instance that needs to generate a set of secret keys for different purposes\n+    \"\"\"\n+    secret_key_b64encoded = models.CharField(max_length=48, blank=True)\n+\n+    class Meta:\n+        abstract = True\n+\n+    def set_random_key(self):\n+        \"\"\"\n+        Generates a random seed for this instance to use when creating\n+        derived secret keys for instance variables\n+        \"\"\"\n+        self.secret_key_b64encoded = generate_secret_key(48)\n+\n+    def get_secret_key_settings(self):\n+        \"\"\"\n+        Render the secret keys template as YAML and return it for use\n+        in the appserver.\n+        \"\"\"\n+        if not self.secret_key_b64encoded:\n+            return ''","path":"instance/models/mixins/secret_keys.py","position":77,"original_position":77,"commit_id":"d513b164a2b0a985388044614b335f4a37f702d4","original_commit_id":"d513b164a2b0a985388044614b335f4a37f702d4","user":{"login":"bradenmacdonald","id":945577,"avatar_url":"https://avatars.githubusercontent.com/u/945577?v=3","gravatar_id":"","url":"https://api.github.com/users/bradenmacdonald","html_url":"https://github.com/bradenmacdonald","followers_url":"https://api.github.com/users/bradenmacdonald/followers","following_url":"https://api.github.com/users/bradenmacdonald/following{/other_user}","gists_url":"https://api.github.com/users/bradenmacdonald/gists{/gist_id}","starred_url":"https://api.github.com/users/bradenmacdonald/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradenmacdonald/subscriptions","organizations_url":"https://api.github.com/users/bradenmacdonald/orgs","repos_url":"https://api.github.com/users/bradenmacdonald/repos","events_url":"https://api.github.com/users/bradenmacdonald/events{/privacy}","received_events_url":"https://api.github.com/users/bradenmacdonald/received_events","type":"User","site_admin":false},"body":"Ah, yeah, I see that now in your test instructions, which I had misunderstood. How about raising an exception if no AppServers currently exist for this instance (in other words, if this is a new instance with no secret key, raise an exception), and logging a warning otherwise?\r\n\r\nIdeally I'd also like to see a warning in the UI for any instance without secret_key set in this manner, but I'll consider that out of scope here for now.","created_at":"2016-10-27T20:34:30Z","updated_at":"2016-10-27T20:34:31Z","html_url":"https://github.com/open-craft/opencraft/pull/147#discussion_r85421781","pull_request_url":"https://api.github.com/repos/open-craft/opencraft/pulls/147","_links":{"self":{"href":"https://api.github.com/repos/open-craft/opencraft/pulls/comments/85421781"},"html":{"href":"https://github.com/open-craft/opencraft/pull/147#discussion_r85421781"},"pull_request":{"href":"https://api.github.com/repos/open-craft/opencraft/pulls/147"}}},"pull_request":{"url":"https://api.github.com/repos/open-craft/opencraft/pulls/147","id":91087063,"html_url":"https://github.com/open-craft/opencraft/pull/147","diff_url":"https://github.com/open-craft/opencraft/pull/147.diff","patch_url":"https://github.com/open-craft/opencraft/pull/147.patch","issue_url":"https://api.github.com/repos/open-craft/opencraft/issues/147","number":147,"state":"open","locked":false,"title":"Add secret key generation to OpenCraft IM","user":{"login":"haikuginger","id":7773758,"avatar_url":"https://avatars.githubusercontent.com/u/7773758?v=3","gravatar_id":"","url":"https://api.github.com/users/haikuginger","html_url":"https://github.com/haikuginger","followers_url":"https://api.github.com/users/haikuginger/followers","following_url":"https://api.github.com/users/haikuginger/following{/other_user}","gists_url":"https://api.github.com/users/haikuginger/gists{/gist_id}","starred_url":"https://api.github.com/users/haikuginger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/haikuginger/subscriptions","organizations_url":"https://api.github.com/users/haikuginger/orgs","repos_url":"https://api.github.com/users/haikuginger/repos","events_url":"https://api.github.com/users/haikuginger/events{/privacy}","received_events_url":"https://api.github.com/users/haikuginger/received_events","type":"User","site_admin":false},"body":"This PR adds logic to automatically generate secret keys for a variety of services populated by OpenCraft IM.\r\n\r\n**Dependencies**: None\r\n\r\n**Testing instructions**:\r\n\r\n1. Using a copy of OCIM as it exists right now, set up an instance and spawn an appserver. There's no need to wait for the appserver to provision; just look at the appserver's vars and observe that items like `EDXAPP_EDXAPP_SECRET_KEY` are not present.\r\n\r\n2. Pull this branch into your existing OCIM instance and migrate it.\r\n\r\n3. Spawn a new appserver on the existing instance. Again, no need to wait for it to provision; just look at the vars in OCIM and observe that items like `EDXAPP_EDXAPP_SECRET_KEY` are still missing - for instances that don't have a master secret key set, we don't want to change things.\r\n\r\n4. Create a new instance and spawn an appserver. Observe that variables like `EDXAPP_EDXAPP_SECRET_KEY` and `FORUM_API_KEY` are populated with seemingly-random values.\r\n\r\n5. Spawn a new appserver on the same instance; observe that its secret key vars have the same values as the first one.\r\n\r\n**Author notes and concerns**:\r\n\r\n1. The current setup is a little awkward. Because the secret keys are derived based on the variable names, we need to have those names in source, not just in a template. I explored other options, but the current setup is robust and allowed me to get the code deployed. I am very open to suggestions on how to improve it - one thought I had was by feeding in the secret keys we're interested in filling as environment variables and building the YAML string entirely in Python, but that seems a bit obfuscated.\r\n\r\n**Reviewers**\r\n- [ ] @bradenmacdonald \r\n","created_at":"2016-10-26T20:58:38Z","updated_at":"2016-10-27T20:34:31Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9217a4feecb5145a59af2bac309f1e0d43b0841f","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/open-craft/opencraft/pulls/147/commits","review_comments_url":"https://api.github.com/repos/open-craft/opencraft/pulls/147/comments","review_comment_url":"https://api.github.com/repos/open-craft/opencraft/pulls/comments{/number}","comments_url":"https://api.github.com/repos/open-craft/opencraft/issues/147/comments","statuses_url":"https://api.github.com/repos/open-craft/opencraft/statuses/d513b164a2b0a985388044614b335f4a37f702d4","head":{"label":"open-craft:haikuginger/populate-secret-keys","ref":"haikuginger/populate-secret-keys","sha":"d513b164a2b0a985388044614b335f4a37f702d4","user":{"login":"open-craft","id":7414786,"avatar_url":"https://avatars.githubusercontent.com/u/7414786?v=3","gravatar_id":"","url":"https://api.github.com/users/open-craft","html_url":"https://github.com/open-craft","followers_url":"https://api.github.com/users/open-craft/followers","following_url":"https://api.github.com/users/open-craft/following{/other_user}","gists_url":"https://api.github.com/users/open-craft/gists{/gist_id}","starred_url":"https://api.github.com/users/open-craft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/open-craft/subscriptions","organizations_url":"https://api.github.com/users/open-craft/orgs","repos_url":"https://api.github.com/users/open-craft/repos","events_url":"https://api.github.com/users/open-craft/events{/privacy}","received_events_url":"https://api.github.com/users/open-craft/received_events","type":"Organization","site_admin":false},"repo":{"id":40447973,"name":"opencraft","full_name":"open-craft/opencraft","owner":{"login":"open-craft","id":7414786,"avatar_url":"https://avatars.githubusercontent.com/u/7414786?v=3","gravatar_id":"","url":"https://api.github.com/users/open-craft","html_url":"https://github.com/open-craft","followers_url":"https://api.github.com/users/open-craft/followers","following_url":"https://api.github.com/users/open-craft/following{/other_user}","gists_url":"https://api.github.com/users/open-craft/gists{/gist_id}","starred_url":"https://api.github.com/users/open-craft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/open-craft/subscriptions","organizations_url":"https://api.github.com/users/open-craft/orgs","repos_url":"https://api.github.com/users/open-craft/repos","events_url":"https://api.github.com/users/open-craft/events{/privacy}","received_events_url":"https://api.github.com/users/open-craft/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/open-craft/opencraft","description":"OpenCraft - Instance Manager","fork":false,"url":"https://api.github.com/repos/open-craft/opencraft","forks_url":"https://api.github.com/repos/open-craft/opencraft/forks","keys_url":"https://api.github.com/repos/open-craft/opencraft/keys{/key_id}","collaborators_url":"https://api.github.com/repos/open-craft/opencraft/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/open-craft/opencraft/teams","hooks_url":"https://api.github.com/repos/open-craft/opencraft/hooks","issue_events_url":"https://api.github.com/repos/open-craft/opencraft/issues/events{/number}","events_url":"https://api.github.com/repos/open-craft/opencraft/events","assignees_url":"https://api.github.com/repos/open-craft/opencraft/assignees{/user}","branches_url":"https://api.github.com/repos/open-craft/opencraft/branches{/branch}","tags_url":"https://api.github.com/repos/open-craft/opencraft/tags","blobs_url":"https://api.github.com/repos/open-craft/opencraft/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/open-craft/opencraft/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/open-craft/opencraft/git/refs{/sha}","trees_url":"https://api.github.com/repos/open-craft/opencraft/git/trees{/sha}","statuses_url":"https://api.github.com/repos/open-craft/opencraft/statuses/{sha}","languages_url":"https://api.github.com/repos/open-craft/opencraft/languages","stargazers_url":"https://api.github.com/repos/open-craft/opencraft/stargazers","contributors_url":"https://api.github.com/repos/open-craft/opencraft/contributors","subscribers_url":"https://api.github.com/repos/open-craft/opencraft/subscribers","subscription_url":"https://api.github.com/repos/open-craft/opencraft/subscription","commits_url":"https://api.github.com/repos/open-craft/opencraft/commits{/sha}","git_commits_url":"https://api.github.com/repos/open-craft/opencraft/git/commits{/sha}","comments_url":"https://api.github.com/repos/open-craft/opencraft/comments{/number}","issue_comment_url":"https://api.github.com/repos/open-craft/opencraft/issues/comments{/number}","contents_url":"https://api.github.com/repos/open-craft/opencraft/contents/{+path}","compare_url":"https://api.github.com/repos/open-craft/opencraft/compare/{base}...{head}","merges_url":"https://api.github.com/repos/open-craft/opencraft/merges","archive_url":"https://api.github.com/repos/open-craft/opencraft/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/open-craft/opencraft/downloads","issues_url":"https://api.github.com/repos/open-craft/opencraft/issues{/number}","pulls_url":"https://api.github.com/repos/open-craft/opencraft/pulls{/number}","milestones_url":"https://api.github.com/repos/open-craft/opencraft/milestones{/number}","notifications_url":"https://api.github.com/repos/open-craft/opencraft/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/open-craft/opencraft/labels{/name}","releases_url":"https://api.github.com/repos/open-craft/opencraft/releases{/id}","deployments_url":"https://api.github.com/repos/open-craft/opencraft/deployments","created_at":"2015-08-09T19:35:05Z","updated_at":"2016-10-24T13:03:53Z","pushed_at":"2016-10-27T18:56:48Z","git_url":"git://github.com/open-craft/opencraft.git","ssh_url":"git@github.com:open-craft/opencraft.git","clone_url":"https://github.com/open-craft/opencraft.git","svn_url":"https://github.com/open-craft/opencraft","homepage":null,"size":2466,"stargazers_count":13,"watchers_count":13,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":9,"mirror_url":null,"open_issues_count":13,"forks":9,"open_issues":13,"watchers":13,"default_branch":"master"}},"base":{"label":"open-craft:master","ref":"master","sha":"5a4138ed89257d98b9d7ca29d94c66846d7453c9","user":{"login":"open-craft","id":7414786,"avatar_url":"https://avatars.githubusercontent.com/u/7414786?v=3","gravatar_id":"","url":"https://api.github.com/users/open-craft","html_url":"https://github.com/open-craft","followers_url":"https://api.github.com/users/open-craft/followers","following_url":"https://api.github.com/users/open-craft/following{/other_user}","gists_url":"https://api.github.com/users/open-craft/gists{/gist_id}","starred_url":"https://api.github.com/users/open-craft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/open-craft/subscriptions","organizations_url":"https://api.github.com/users/open-craft/orgs","repos_url":"https://api.github.com/users/open-craft/repos","events_url":"https://api.github.com/users/open-craft/events{/privacy}","received_events_url":"https://api.github.com/users/open-craft/received_events","type":"Organization","site_admin":false},"repo":{"id":40447973,"name":"opencraft","full_name":"open-craft/opencraft","owner":{"login":"open-craft","id":7414786,"avatar_url":"https://avatars.githubusercontent.com/u/7414786?v=3","gravatar_id":"","url":"https://api.github.com/users/open-craft","html_url":"https://github.com/open-craft","followers_url":"https://api.github.com/users/open-craft/followers","following_url":"https://api.github.com/users/open-craft/following{/other_user}","gists_url":"https://api.github.com/users/open-craft/gists{/gist_id}","starred_url":"https://api.github.com/users/open-craft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/open-craft/subscriptions","organizations_url":"https://api.github.com/users/open-craft/orgs","repos_url":"https://api.github.com/users/open-craft/repos","events_url":"https://api.github.com/users/open-craft/events{/privacy}","received_events_url":"https://api.github.com/users/open-craft/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/open-craft/opencraft","description":"OpenCraft - Instance Manager","fork":false,"url":"https://api.github.com/repos/open-craft/opencraft","forks_url":"https://api.github.com/repos/open-craft/opencraft/forks","keys_url":"https://api.github.com/repos/open-craft/opencraft/keys{/key_id}","collaborators_url":"https://api.github.com/repos/open-craft/opencraft/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/open-craft/opencraft/teams","hooks_url":"https://api.github.com/repos/open-craft/opencraft/hooks","issue_events_url":"https://api.github.com/repos/open-craft/opencraft/issues/events{/number}","events_url":"https://api.github.com/repos/open-craft/opencraft/events","assignees_url":"https://api.github.com/repos/open-craft/opencraft/assignees{/user}","branches_url":"https://api.github.com/repos/open-craft/opencraft/branches{/branch}","tags_url":"https://api.github.com/repos/open-craft/opencraft/tags","blobs_url":"https://api.github.com/repos/open-craft/opencraft/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/open-craft/opencraft/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/open-craft/opencraft/git/refs{/sha}","trees_url":"https://api.github.com/repos/open-craft/opencraft/git/trees{/sha}","statuses_url":"https://api.github.com/repos/open-craft/opencraft/statuses/{sha}","languages_url":"https://api.github.com/repos/open-craft/opencraft/languages","stargazers_url":"https://api.github.com/repos/open-craft/opencraft/stargazers","contributors_url":"https://api.github.com/repos/open-craft/opencraft/contributors","subscribers_url":"https://api.github.com/repos/open-craft/opencraft/subscribers","subscription_url":"https://api.github.com/repos/open-craft/opencraft/subscription","commits_url":"https://api.github.com/repos/open-craft/opencraft/commits{/sha}","git_commits_url":"https://api.github.com/repos/open-craft/opencraft/git/commits{/sha}","comments_url":"https://api.github.com/repos/open-craft/opencraft/comments{/number}","issue_comment_url":"https://api.github.com/repos/open-craft/opencraft/issues/comments{/number}","contents_url":"https://api.github.com/repos/open-craft/opencraft/contents/{+path}","compare_url":"https://api.github.com/repos/open-craft/opencraft/compare/{base}...{head}","merges_url":"https://api.github.com/repos/open-craft/opencraft/merges","archive_url":"https://api.github.com/repos/open-craft/opencraft/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/open-craft/opencraft/downloads","issues_url":"https://api.github.com/repos/open-craft/opencraft/issues{/number}","pulls_url":"https://api.github.com/repos/open-craft/opencraft/pulls{/number}","milestones_url":"https://api.github.com/repos/open-craft/opencraft/milestones{/number}","notifications_url":"https://api.github.com/repos/open-craft/opencraft/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/open-craft/opencraft/labels{/name}","releases_url":"https://api.github.com/repos/open-craft/opencraft/releases{/id}","deployments_url":"https://api.github.com/repos/open-craft/opencraft/deployments","created_at":"2015-08-09T19:35:05Z","updated_at":"2016-10-24T13:03:53Z","pushed_at":"2016-10-27T18:56:48Z","git_url":"git://github.com/open-craft/opencraft.git","ssh_url":"git@github.com:open-craft/opencraft.git","clone_url":"https://github.com/open-craft/opencraft.git","svn_url":"https://github.com/open-craft/opencraft","homepage":null,"size":2466,"stargazers_count":13,"watchers_count":13,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":9,"mirror_url":null,"open_issues_count":13,"forks":9,"open_issues":13,"watchers":13,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/open-craft/opencraft/pulls/147"},"html":{"href":"https://github.com/open-craft/opencraft/pull/147"},"issue":{"href":"https://api.github.com/repos/open-craft/opencraft/issues/147"},"comments":{"href":"https://api.github.com/repos/open-craft/opencraft/issues/147/comments"},"review_comments":{"href":"https://api.github.com/repos/open-craft/opencraft/pulls/147/comments"},"review_comment":{"href":"https://api.github.com/repos/open-craft/opencraft/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/open-craft/opencraft/pulls/147/commits"},"statuses":{"href":"https://api.github.com/repos/open-craft/opencraft/statuses/d513b164a2b0a985388044614b335f4a37f702d4"}}}}
{"actor":{"display_login":"bradenmacdonald"}}