Config

class gafaelfawr.config.Config(realm, log_level, session_secret, redis_url, redis_password, database_url, database_password, bootstrap_token, token_lifetime, proxies, after_logout_url, error_footer, slack_webhook, github, oidc, ldap, firestore, forgerock, oidc_server, quota, initial_admins, known_scopes, group_mapping)

Bases: object

Configuration for Gafaelfawr.

The internal representation of the configuration, created from the Settings model.

Some configuration parameters from the configuration file are copied into multiple configuration dataclasses. This allows the configuration for each internal component to be self-contained and unaware of the configuration of the rest of the application.

Parameters:

• realm (str) –

• log_level (LogLevel) –

• session_secret (str) –

• redis_url (str) –

• redis_password (Optional[str]) –

• database_url (str) –

• database_password (Optional[str]) –

• bootstrap_token (Optional[Token]) –

• token_lifetime (timedelta) –

• proxies (tuple[IPv4Network | IPv6Network, ...]) –

• after_logout_url (str) –

• error_footer (Optional[str]) –

• slack_webhook (Optional[str]) –

• github (Optional[GitHubConfig]) –

• oidc (Optional[OIDCConfig]) –

• ldap (Optional[LDAPConfig]) –

• firestore (Optional[FirestoreConfig]) –

• forgerock (Optional[ForgeRockConfig]) –

• oidc_server (Optional[OIDCServerConfig]) –

• quota (Optional[Quota]) –

• initial_admins (tuple[str, ...]) –

• known_scopes (Mapping[str, str]) –

• group_mapping (Mapping[str, frozenset[str]]) –

Attributes Summary

after_logout_url	Default URL to which to send the user after logging out.
bootstrap_token	Bootstrap authentication token.
database_password	Password for the PostgreSQL database.
database_url	URL for the PostgreSQL database.
error_footer	HTML to add (inside <p>) to login error pages.
firestore	Settings for Firestore-based UID/GID assignment.
forgerock	Configuration for ForgeRock Identity Management server.
github	Configuration for GitHub authentication.
group_mapping	Mapping of group names to the set of scopes that group grants.
initial_admins	Initial token administrators to configure when initializing database.
known_scopes	Known scopes (the keys) and their descriptions (the values).
ldap	Configuration for LDAP.
log_level	Level for logging.
oidc	Configuration for OpenID Connect authentication.
oidc_server	Configuration for the OpenID Connect server.
proxies	Trusted proxy IP netblocks in front of Gafaelfawr.
quota	Quota for users.
realm	Realm for HTTP authentication.
redis_password	Password for the Redis server that stores sessions.
redis_url	URL for the Redis server that stores sessions.
session_secret	Secret used to encrypt the session cookie and session store.
slack_webhook	Slack webhook to which to post alerts.
token_lifetime	Maximum lifetime of session, notebook, and internal tokens.

Attributes Documentation

after_logout_url: str

Default URL to which to send the user after logging out.

bootstrap_token: Optional[Token]

Bootstrap authentication token.

This token can be used with specific routes in the admin API to change the list of admins and create service and user tokens.

database_password: Optional[str]

Password for the PostgreSQL database.

database_url: str

URL for the PostgreSQL database.

error_footer: Optional[str]

HTML to add (inside <p>) to login error pages.

firestore: Optional[FirestoreConfig]

Settings for Firestore-based UID/GID assignment.

forgerock: Optional[ForgeRockConfig]

Configuration for ForgeRock Identity Management server.

github: Optional[GitHubConfig]

Configuration for GitHub authentication.

group_mapping: Mapping[str, frozenset[str]]

Mapping of group names to the set of scopes that group grants.

initial_admins: tuple[str, ...]

Initial token administrators to configure when initializing database.

known_scopes: Mapping[str, str]

Known scopes (the keys) and their descriptions (the values).

ldap: Optional[LDAPConfig]

Configuration for LDAP.

log_level: LogLevel

Level for logging.

oidc: Optional[OIDCConfig]

Configuration for OpenID Connect authentication.

oidc_server: Optional[OIDCServerConfig]

Configuration for the OpenID Connect server.

proxies: tuple[IPv4Network | IPv6Network, ...]

Trusted proxy IP netblocks in front of Gafaelfawr.

If this is set to a non-empty list, it will be used as the trusted list of proxies when parsing X-Forwarded-For for the /auth route. IP addresses from that header will be discarded from the right side when they match an entry in this list until a non-matching IP is reached or there is only one IP left, and then that IP will be used as the remote IP for logging purposes. This will allow logging of accurate client IP addresses.

quota: Optional[Quota]

Quota for users.

realm: str

Realm for HTTP authentication.

redis_password: Optional[str]

Password for the Redis server that stores sessions.

redis_url: str

URL for the Redis server that stores sessions.

session_secret: str

Secret used to encrypt the session cookie and session store.

slack_webhook: Optional[str]

Slack webhook to which to post alerts.

token_lifetime: timedelta

Maximum lifetime of session, notebook, and internal tokens.