a509bdcb2e
All checks were successful
- Remove port 143 from mailserver (only expose 993/IMAPS) - Enable SSL_TYPE=manual with Let's Encrypt certs - Set DOVECOT_DISABLE_PLAINTEXT_AUTH=yes - Add pentest_imap_tls config field (defaults to true) Fixes CERT-Bund report: IMAP PLAIN/LOGIN without TLS on 46.225.100.82:143 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
64 lines
3.1 KiB
Rust
64 lines
3.1 KiB
Rust
use compliance_core::AgentConfig;
|
|
use secrecy::SecretString;
|
|
|
|
use crate::error::AgentError;
|
|
|
|
fn env_var(key: &str) -> Result<String, AgentError> {
|
|
std::env::var(key).map_err(|_| AgentError::Config(format!("Missing env var: {key}")))
|
|
}
|
|
|
|
fn env_var_opt(key: &str) -> Option<String> {
|
|
std::env::var(key).ok().filter(|v| !v.is_empty())
|
|
}
|
|
|
|
fn env_secret_opt(key: &str) -> Option<SecretString> {
|
|
env_var_opt(key).map(SecretString::from)
|
|
}
|
|
|
|
pub fn load_config() -> Result<AgentConfig, AgentError> {
|
|
Ok(AgentConfig {
|
|
mongodb_uri: env_var("MONGODB_URI")?,
|
|
mongodb_database: env_var_opt("MONGODB_DATABASE")
|
|
.unwrap_or_else(|| "compliance_scanner".to_string()),
|
|
litellm_url: env_var_opt("LITELLM_URL")
|
|
.unwrap_or_else(|| "http://localhost:4000".to_string()),
|
|
litellm_api_key: SecretString::from(env_var_opt("LITELLM_API_KEY").unwrap_or_default()),
|
|
litellm_model: env_var_opt("LITELLM_MODEL").unwrap_or_else(|| "gpt-4o".to_string()),
|
|
litellm_embed_model: env_var_opt("LITELLM_EMBED_MODEL")
|
|
.unwrap_or_else(|| "text-embedding-3-small".to_string()),
|
|
github_token: env_secret_opt("GITHUB_TOKEN"),
|
|
github_webhook_secret: env_secret_opt("GITHUB_WEBHOOK_SECRET"),
|
|
gitlab_url: env_var_opt("GITLAB_URL"),
|
|
gitlab_token: env_secret_opt("GITLAB_TOKEN"),
|
|
gitlab_webhook_secret: env_secret_opt("GITLAB_WEBHOOK_SECRET"),
|
|
jira_url: env_var_opt("JIRA_URL"),
|
|
jira_email: env_var_opt("JIRA_EMAIL"),
|
|
jira_api_token: env_secret_opt("JIRA_API_TOKEN"),
|
|
jira_project_key: env_var_opt("JIRA_PROJECT_KEY"),
|
|
searxng_url: env_var_opt("SEARXNG_URL"),
|
|
nvd_api_key: env_secret_opt("NVD_API_KEY"),
|
|
agent_port: env_var_opt("AGENT_PORT")
|
|
.and_then(|p| p.parse().ok())
|
|
.unwrap_or(3001),
|
|
scan_schedule: env_var_opt("SCAN_SCHEDULE").unwrap_or_else(|| "0 0 */6 * * *".to_string()),
|
|
cve_monitor_schedule: env_var_opt("CVE_MONITOR_SCHEDULE")
|
|
.unwrap_or_else(|| "0 0 0 * * *".to_string()),
|
|
git_clone_base_path: env_var_opt("GIT_CLONE_BASE_PATH")
|
|
.unwrap_or_else(|| "/tmp/compliance-scanner/repos".to_string()),
|
|
ssh_key_path: env_var_opt("SSH_KEY_PATH")
|
|
.unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
|
|
keycloak_url: env_var_opt("KEYCLOAK_URL"),
|
|
keycloak_realm: env_var_opt("KEYCLOAK_REALM"),
|
|
keycloak_admin_username: env_var_opt("KEYCLOAK_ADMIN_USERNAME"),
|
|
keycloak_admin_password: env_secret_opt("KEYCLOAK_ADMIN_PASSWORD"),
|
|
pentest_verification_email: env_var_opt("PENTEST_VERIFICATION_EMAIL"),
|
|
pentest_imap_host: env_var_opt("PENTEST_IMAP_HOST"),
|
|
pentest_imap_port: env_var_opt("PENTEST_IMAP_PORT").and_then(|p| p.parse().ok()),
|
|
pentest_imap_tls: env_var_opt("PENTEST_IMAP_TLS")
|
|
.map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
|
|
.unwrap_or(true),
|
|
pentest_imap_username: env_var_opt("PENTEST_IMAP_USERNAME"),
|
|
pentest_imap_password: env_secret_opt("PENTEST_IMAP_PASSWORD"),
|
|
})
|
|
}
|