csrd-utils 0.3.14__tar.gz → 0.3.16__tar.gz

{csrd_utils-0.3.14 → csrd_utils-0.3.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: csrd-utils
-Version: 0.3.14
+Version: 0.3.16
 Summary: CLI utilities for csrd service generation and feature augmentation
 Project-URL: Repository, https://github.com/csrd-api/fastapi-common
 Project-URL: Documentation, https://github.com/csrd-api/fastapi-common/tree/main/packages/utils
@@ -38,6 +38,8 @@ csrd feature plan workers --service .
 csrd feature plan workers --service . --json
 csrd feature add workers --service .
 csrd doctor --service .
+csrd audit                                          # if cwd is workspace, audits all services
+csrd audit --service .                              # explicitly audit one service path
 ```
 
 `feature plan --json` is useful for CI or tooling wrappers.
@@ -70,6 +72,9 @@ csrd new service --name inventory --output ./local-dev --database postgres --wor
 # 1) Verify service compatibility
 csrd doctor --service ./local-dev/inventory
 
+# 1b) Audit for weak/insecure defaults
+csrd audit --service ./local-dev/inventory
+
 # 2) Inspect available bundled features
 csrd feature list
 
@@ -120,6 +125,7 @@ csrd new service --help
 csrd new cluster --help
 csrd feature --help
 csrd doctor --help
+csrd audit --help
 csrd feature list
 ```
 
@@ -130,6 +136,7 @@ mkdir -p /tmp/csrd-smoke
 csrd new workspace --name ws --output /tmp/csrd-smoke --generate none
 csrd new service --name demo-svc --output /tmp/csrd-smoke/ws --no-interactive
 csrd doctor --service /tmp/csrd-smoke/ws/demo-svc
+csrd audit --service /tmp/csrd-smoke/ws/demo-svc
 csrd feature plan workers --service /tmp/csrd-smoke/ws/demo-svc
 csrd feature add workers --service /tmp/csrd-smoke/ws/demo-svc
 ```

{csrd_utils-0.3.14 → csrd_utils-0.3.16}/README.md

@@ -25,6 +25,8 @@ csrd feature plan workers --service .
 csrd feature plan workers --service . --json
 csrd feature add workers --service .
 csrd doctor --service .
+csrd audit                                          # if cwd is workspace, audits all services
+csrd audit --service .                              # explicitly audit one service path
 ```
 
 `feature plan --json` is useful for CI or tooling wrappers.
@@ -57,6 +59,9 @@ csrd new service --name inventory --output ./local-dev --database postgres --wor
 # 1) Verify service compatibility
 csrd doctor --service ./local-dev/inventory
 
+# 1b) Audit for weak/insecure defaults
+csrd audit --service ./local-dev/inventory
+
 # 2) Inspect available bundled features
 csrd feature list
 
@@ -107,6 +112,7 @@ csrd new service --help
 csrd new cluster --help
 csrd feature --help
 csrd doctor --help
+csrd audit --help
 csrd feature list
 ```
 
@@ -117,6 +123,7 @@ mkdir -p /tmp/csrd-smoke
 csrd new workspace --name ws --output /tmp/csrd-smoke --generate none
 csrd new service --name demo-svc --output /tmp/csrd-smoke/ws --no-interactive
 csrd doctor --service /tmp/csrd-smoke/ws/demo-svc
+csrd audit --service /tmp/csrd-smoke/ws/demo-svc
 csrd feature plan workers --service /tmp/csrd-smoke/ws/demo-svc
 csrd feature add workers --service /tmp/csrd-smoke/ws/demo-svc
 ```

{csrd_utils-0.3.14 → csrd_utils-0.3.16}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "csrd-utils"
-version = "0.3.14"
+version = "0.3.16"
 description = "CLI utilities for csrd service generation and feature augmentation"
 license = { text = "MIT" }
 requires-python = ">=3.12"

{csrd_utils-0.3.14 → csrd_utils-0.3.16}/src/csrd_utils/__init__.py

@@ -1,7 +1,8 @@
 """csrd-utils: template and feature tooling for csrd services."""
 
+from .audit import run_audit
 from .augmentor import ServiceAugmentor
 from .doctor import run_doctor
 from .generator import generate_service
 
-__all__ = ["ServiceAugmentor", "generate_service", "run_doctor"]
+__all__ = ["ServiceAugmentor", "generate_service", "run_audit", "run_doctor"]

{csrd_utils-0.3.14 → csrd_utils-0.3.16}/src/csrd_utils/__main__.py

@@ -1,7 +1,5 @@
 """Command-line interface for csrd-utils."""
 
-from __future__ import annotations
-
 import argparse
 import json
 from contextlib import suppress
@@ -12,6 +10,7 @@ from urllib.parse import urlparse
 
 import yaml  # type: ignore[import-untyped]
 
+from .audit import run_audit
 from .augmentor import ServiceAugmentor
 from .cluster import (
     PRESETS,
@@ -423,10 +422,9 @@ def _service_config_to_cluster_service(config: GenerateServiceArgs) -> ServiceSp
     has_database = config["has_database"]
     has_workers = config["has_workers"]
     has_delegates = config["has_delegates"]
-    selected_roles = sum(1 for enabled in (has_database, has_workers, has_delegates) if enabled)
-    if selected_roles > 1:
+    if has_workers and (has_database or has_delegates):
         raise ValueError(
-            "Workspace cluster mapping supports one core role per generated service (database or workers or delegates)."
+            "Workspace cluster mapping does not support combining workers with database or delegates in one service."
         )
 
     service: ServiceSpec = {
@@ -439,6 +437,10 @@ def _service_config_to_cluster_service(config: GenerateServiceArgs) -> ServiceSp
     if has_database:
         service["type"] = "db"
         service["database"] = config["database"]
+        if has_delegates:
+            targets = _delegate_targets_from_upstreams(config["upstreams"])
+            service["delegates"] = targets
+            service["requires"] = list(targets)
     elif has_workers:
         service["type"] = "worker"
         service["broker"] = config["broker"]
@@ -604,6 +606,15 @@ def _build_parser() -> argparse.ArgumentParser:
     doctor.add_argument("--service", type=Path, default=Path.cwd(), help="Service root path")
     doctor.add_argument("--json", action="store_true", help="Print doctor report as JSON")
 
+    audit = sub.add_parser("audit", help="Audit weak or insecure service defaults")
+    audit.add_argument(
+        "--service",
+        type=Path,
+        default=None,
+        help="Optional single-service path; if omitted and cwd is workspace, all workspace services are audited",
+    )
+    audit.add_argument("--json", action="store_true", help="Print audit report as JSON")
+
     new = sub.add_parser("new", help="Generate new assets")
     new_sub = new.add_subparsers(dest="new_command", required=True)
     service = new_sub.add_parser("service", help="Generate a service from bundled template")
@@ -706,6 +717,90 @@ def _run_doctor(service: Path, as_json: bool) -> int:
     return 0 if report.ok else 1
 
 
+def _run_audit(service: Path | None, as_json: bool) -> int:
+    target = service.resolve() if service is not None else Path.cwd().resolve()
+
+    if _is_workspace(target):
+        service_roots = _workspace_service_roots(target)
+        service_reports: list[dict[str, object]] = []
+        has_high = False
+        for service_root in service_roots:
+            report = run_audit(service_root)
+            has_high = has_high or not report.ok
+            service_reports.append(
+                {
+                    "service": service_root.name,
+                    "path": str(service_root),
+                    **report.to_payload(),
+                }
+            )
+
+        payload = {
+            "ok": not has_high,
+            "mode": "workspace",
+            "workspace": str(target),
+            "services": service_reports,
+            "summary": {
+                "services_scanned": len(service_reports),
+                "services_with_high": sum(
+                    1
+                    for service_report in service_reports
+                    if isinstance(service_report.get("ok"), bool) and not service_report["ok"]
+                ),
+            },
+        }
+    else:
+        report = run_audit(target)
+        payload = {
+            "mode": "service",
+            "service": str(target),
+            **report.to_payload(),
+        }
+
+    if as_json:
+        print(json.dumps(payload, indent=2, sort_keys=True))
+    else:
+        if payload["ok"]:
+            print("Audit passed (no high-severity findings).")
+        else:
+            print("Audit failed (high-severity findings detected).")
+
+        if payload.get("mode") == "workspace":
+            print(f"Workspace: {payload['workspace']}")
+            services = payload.get("services", [])
+            if isinstance(services, list):
+                for service_report in services:
+                    if not isinstance(service_report, dict):
+                        continue
+                    state = "OK" if service_report.get("ok") else "FAIL"
+                    print(f"- {service_report.get('service', '<unknown>')}: {state}")
+                    findings = service_report.get("findings", [])
+                    if isinstance(findings, list):
+                        for finding in findings:
+                            if not isinstance(finding, dict):
+                                continue
+                            print(
+                                f"  {str(finding.get('severity', '')).upper()}: "
+                                f"[{finding.get('rule')}] {finding.get('file')} :: {finding.get('message')}"
+                            )
+                            print(f"    evidence: {finding.get('evidence')}")
+                            print(f"    fix: {finding.get('remediation')}")
+        else:
+            findings = payload.get("findings", [])
+            if isinstance(findings, list):
+                for finding in findings:
+                    if not isinstance(finding, dict):
+                        continue
+                    print(
+                        f"{str(finding.get('severity', '')).upper()}: "
+                        f"[{finding.get('rule')}] {finding.get('file')} :: {finding.get('message')}"
+                    )
+                    print(f"  evidence: {finding.get('evidence')}")
+                    print(f"  fix: {finding.get('remediation')}")
+
+    return 0 if bool(payload["ok"]) else 1
+
+
 def main() -> int:
     parser = _build_parser()
     args = parser.parse_args()
@@ -788,6 +883,9 @@ def main() -> int:
     if args.command == "doctor":
         return _run_doctor(args.service, args.json)
 
+    if args.command == "audit":
+        return _run_audit(args.service, args.json)
+
     if args.command != "feature" or args.feature_command not in {"add", "plan", "list"}:
         parser.print_help()
         return 0

csrd_utils-0.3.16/src/csrd_utils/audit.py

@@ -0,0 +1,192 @@
+"""Security hardening audit checks for generated services."""
+
+import re
+from dataclasses import asdict, dataclass, field
+from pathlib import Path
+
+
+@dataclass
+class AuditFinding:
+    """A single hardening finding."""
+
+    rule: str
+    severity: str
+    message: str
+    file: str
+    evidence: str
+    remediation: str
+
+
+@dataclass
+class AuditReport:
+    """Structured audit output."""
+
+    ok: bool
+    findings: list[AuditFinding] = field(default_factory=list)
+
+    def to_payload(self) -> dict[str, object]:
+        return {
+            "ok": self.ok,
+            "findings": [asdict(finding) for finding in self.findings],
+            "summary": {
+                "high": sum(1 for finding in self.findings if finding.severity == "high"),
+                "medium": sum(1 for finding in self.findings if finding.severity == "medium"),
+                "low": sum(1 for finding in self.findings if finding.severity == "low"),
+            },
+        }
+
+
+_WEAK_PASSWORDS = r"(?:change_me|change_me_root|app|sandbox|password|root)"
+_WEAK_IDENTIFIERS = r"(?:service_user|service_db|app|sandbox)"
+
+
+def _scan_file(path: Path, root: Path) -> list[AuditFinding]:
+    findings: list[AuditFinding] = []
+
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError:
+        return findings
+
+    rel = str(path.relative_to(root))
+
+    password_hits = re.findall(
+        rf"(?:DB_PASSWORD|POSTGRES_PASSWORD|MYSQL_PASSWORD|MARIADB_PASSWORD)\s*[:=]\s*['\"]?({_WEAK_PASSWORDS})['\"]?",
+        text,
+        flags=re.IGNORECASE,
+    )
+    if password_hits:
+        findings.append(
+            AuditFinding(
+                rule="weak-db-password-default",
+                severity="high",
+                message="Weak default database password is configured.",
+                file=rel,
+                evidence=password_hits[0],
+                remediation="Set a strong DB password via environment configuration.",
+            )
+        )
+
+    root_hits = re.findall(
+        rf"(?:MYSQL_ROOT_PASSWORD|MARIADB_ROOT_PASSWORD)\s*[:=]\s*['\"]?({_WEAK_PASSWORDS})['\"]?",
+        text,
+        flags=re.IGNORECASE,
+    )
+    if root_hits:
+        findings.append(
+            AuditFinding(
+                rule="weak-root-db-password-default",
+                severity="high",
+                message="Weak root database password is configured.",
+                file=rel,
+                evidence=root_hits[0],
+                remediation="Set a strong root password and avoid shared defaults.",
+            )
+        )
+
+    identifier_hits = re.findall(
+        rf"(?:DB_USER|POSTGRES_USER|MYSQL_USER|MARIADB_USER|DB_NAME|POSTGRES_DB|MYSQL_DATABASE|MARIADB_DATABASE)\s*[:=]\s*['\"]?({_WEAK_IDENTIFIERS})['\"]?",
+        text,
+        flags=re.IGNORECASE,
+    )
+    if identifier_hits:
+        findings.append(
+            AuditFinding(
+                rule="weak-db-identifier-default",
+                severity="medium",
+                message="Weak default DB user/database identifier is configured.",
+                file=rel,
+                evidence=identifier_hits[0],
+                remediation="Set DB_USER and DB_NAME to service-specific values per environment.",
+            )
+        )
+
+    if "include_actuator_endpoints=True" in text or "INCLUDE_ACTUATOR_ENDPOINTS=true" in text:
+        findings.append(
+            AuditFinding(
+                rule="actuator-endpoints-enabled",
+                severity="medium",
+                message="Actuator endpoints are enabled by default.",
+                file=rel,
+                evidence="include_actuator_endpoints=True",
+                remediation="Set INCLUDE_ACTUATOR_ENDPOINTS=false unless required on trusted networks.",
+            )
+        )
+
+    if 'allow_origins=["*"]' in text or "allow_origins=['*']" in text:
+        findings.append(
+            AuditFinding(
+                rule="cors-wildcard-origin",
+                severity="medium",
+                message="CORS wildcard origin is configured.",
+                file=rel,
+                evidence='allow_origins=["*"]',
+                remediation="Restrict CORS to known trusted origins.",
+            )
+        )
+
+    if "guest:guest" in text:
+        findings.append(
+            AuditFinding(
+                rule="rabbitmq-guest-default",
+                severity="medium",
+                message="RabbitMQ guest credentials are configured.",
+                file=rel,
+                evidence="guest:guest",
+                remediation="Set RABBITMQ_USER and RABBITMQ_PASSWORD explicitly.",
+            )
+        )
+
+    if "--reload" in text:
+        findings.append(
+            AuditFinding(
+                rule="dev-reload-usage",
+                severity="low",
+                message="Development reload mode appears in runnable commands.",
+                file=rel,
+                evidence="--reload",
+                remediation="Avoid reload mode in production run commands.",
+            )
+        )
+
+    return findings
+
+
+def run_audit(service_root: Path) -> AuditReport:
+    """Scan a service path for insecure defaults and weak auto-configuration."""
+    root = service_root.resolve()
+    findings: list[AuditFinding] = []
+
+    if not root.exists() or not root.is_dir():
+        findings.append(
+            AuditFinding(
+                rule="invalid-service-path",
+                severity="high",
+                message="Service path does not exist or is not a directory.",
+                file=str(service_root),
+                evidence=str(service_root),
+                remediation="Provide a valid service root path.",
+            )
+        )
+        return AuditReport(ok=False, findings=findings)
+
+    candidates: list[Path] = []
+    include_names = {"docker-compose.yml", ".env", ".env.example", "README.md", "settings.py"}
+
+    for path in root.rglob("*"):
+        if not path.is_file():
+            continue
+        if path.name in include_names or path.suffix in {".py", ".yml", ".yaml", ".env", ".md"}:
+            candidates.append(path)
+
+    seen: set[tuple[str, str, str]] = set()
+    for path in candidates:
+        for finding in _scan_file(path, root):
+            key = (finding.rule, finding.file, finding.evidence)
+            if key in seen:
+                continue
+            seen.add(key)
+            findings.append(finding)
+
+    has_high = any(finding.severity == "high" for finding in findings)
+    return AuditReport(ok=not has_high, findings=findings)

{csrd_utils-0.3.14 → csrd_utils-0.3.16}/src/csrd_utils/augmentor.py

@@ -1,7 +1,5 @@
 """Core augmentor logic for adding features to existing services."""
 
-from __future__ import annotations
-
 import shutil
 import tempfile
 from pathlib import Path

{csrd_utils-0.3.14 → csrd_utils-0.3.16}/src/csrd_utils/cluster.py

@@ -1,7 +1,5 @@
 """Cluster scaffolding helpers for csrd-utils."""
 
-from __future__ import annotations
-
 from collections.abc import Iterable
 from pathlib import Path
 from typing import Any, TypedDict, cast
@@ -157,6 +155,12 @@ def normalize_cluster_spec(spec: ClusterSpec) -> ClusterSpec:
                 delegates = _split_csv(delegates)
             normalized_service["delegates"] = list(delegates)
 
+        if service_type == "db" and "delegates" in service:
+            delegates = service.get("delegates", [])
+            if isinstance(delegates, str):
+                delegates = _split_csv(delegates)
+            normalized_service["delegates"] = list(delegates)
+
         if service_type == "worker":
             broker = str(service.get("broker", "")).strip() or "redis"
             if broker not in {"redis", "rabbitmq"}:
@@ -240,19 +244,19 @@ def _service_environment(service: ServiceSpec, services: list[ServiceSpec]) -> d
     if service["type"] == "db":
         db = service.get("database")
         if db == "sqlite":
-            env["DB_PATH"] = "./sandbox.db"
+            env["DB_PATH"] = "./service.db"
         elif db == "maria":
             env["DB_HOST"] = "mariadb"
             env["DB_PORT"] = "3306"
-            env["DB_USER"] = "sandbox"
-            env["DB_PASSWORD"] = "sandbox"
-            env["DB_NAME"] = "sandbox"
+            env["DB_USER"] = "${DB_USER:-service_user}"
+            env["DB_PASSWORD"] = "${DB_PASSWORD:-change_me}"
+            env["DB_NAME"] = "${DB_NAME:-service_db}"
         elif db == "postgres":
             env["DB_HOST"] = "postgres"
             env["DB_PORT"] = "5432"
-            env["DB_USER"] = "sandbox"
-            env["DB_PASSWORD"] = "sandbox"
-            env["DB_NAME"] = "sandbox"
+            env["DB_USER"] = "${DB_USER:-service_user}"
+            env["DB_PASSWORD"] = "${DB_PASSWORD:-change_me}"
+            env["DB_NAME"] = "${DB_NAME:-service_db}"
 
     if service["type"] == "worker":
         broker = service.get("broker", "redis")
@@ -260,7 +264,9 @@ def _service_environment(service: ServiceSpec, services: list[ServiceSpec]) -> d
             env["CELERY_BROKER_URL"] = "redis://redis:6379/0"
             env["CELERY_RESULT_BACKEND"] = "redis://redis:6379/1"
         else:
-            env["CELERY_BROKER_URL"] = "amqp://guest:guest@rabbitmq:5672//"
+            env["CELERY_BROKER_URL"] = (
+                "amqp://${RABBITMQ_USER:-service_rabbit}:${RABBITMQ_PASSWORD:-change_me}@rabbitmq:5672//"
+            )
             env["CELERY_RESULT_BACKEND"] = "rpc://"
 
     for target in service.get("delegates", []):
@@ -323,13 +329,13 @@ def render_compose(spec: ClusterSpec) -> dict[str, Any]:
         compose["services"]["postgres"] = {
             "image": "postgres:16",
             "environment": {
-                "POSTGRES_DB": "sandbox",
-                "POSTGRES_USER": "sandbox",
-                "POSTGRES_PASSWORD": "sandbox",
+                "POSTGRES_DB": "${DB_NAME:-service_db}",
+                "POSTGRES_USER": "${DB_USER:-service_user}",
+                "POSTGRES_PASSWORD": "${DB_PASSWORD:-change_me}",
             },
             "ports": ["5432:5432"],
             "healthcheck": {
-                "test": ["CMD-SHELL", "pg_isready -U sandbox"],
+                "test": ["CMD-SHELL", "pg_isready -U ${DB_USER:-service_user}"],
                 "interval": "10s",
                 "timeout": "5s",
                 "retries": 5,
@@ -340,10 +346,10 @@ def render_compose(spec: ClusterSpec) -> dict[str, Any]:
         compose["services"]["mariadb"] = {
             "image": "mariadb:11",
             "environment": {
-                "MYSQL_ROOT_PASSWORD": "root",
-                "MYSQL_DATABASE": "sandbox",
-                "MYSQL_USER": "sandbox",
-                "MYSQL_PASSWORD": "sandbox",
+                "MYSQL_ROOT_PASSWORD": "${MYSQL_ROOT_PASSWORD:-change_me_root}",
+                "MYSQL_DATABASE": "${DB_NAME:-service_db}",
+                "MYSQL_USER": "${DB_USER:-service_user}",
+                "MYSQL_PASSWORD": "${DB_PASSWORD:-change_me}",
             },
             "ports": ["3306:3306"],
             "healthcheck": {
@@ -369,6 +375,10 @@ def render_compose(spec: ClusterSpec) -> dict[str, Any]:
     if "rabbitmq" in infra:
         compose["services"]["rabbitmq"] = {
             "image": "rabbitmq:3-management",
+            "environment": {
+                "RABBITMQ_DEFAULT_USER": "${RABBITMQ_USER:-service_rabbit}",
+                "RABBITMQ_DEFAULT_PASS": "${RABBITMQ_PASSWORD:-change_me}",
+            },
             "ports": ["5672:5672", "15672:15672"],
             "healthcheck": {
                 "test": ["CMD", "rabbitmq-diagnostics", "-q", "ping"],
@@ -385,6 +395,12 @@ def _build_env(spec: ClusterSpec) -> str:
     lines = [
         "# Cluster-level environment",
         f"CLUSTER_NAME={spec['cluster']['name']}",
+        "DB_USER=service_user",
+        "DB_PASSWORD=change_me",
+        "DB_NAME=service_db",
+        "MYSQL_ROOT_PASSWORD=change_me_root",
+        "RABBITMQ_USER=service_rabbit",
+        "RABBITMQ_PASSWORD=change_me",
         "",
         "# Service URLs",
     ]

{csrd_utils-0.3.14 → csrd_utils-0.3.16}/src/csrd_utils/doctor.py

@@ -1,7 +1,5 @@
 """Preflight checks for services targeted by csrd-utils feature augmentation."""
 
-from __future__ import annotations
-
 from dataclasses import dataclass, field
 from pathlib import Path
 

csrd_utils-0.3.16/src/csrd_utils/features/caching/conftest.fragment.py

@@ -0,0 +1,22 @@
+# [INSERT: fixtures]
+@pytest.fixture  # noqa: F821
+def cache_client(monkeypatch):
+    """Fake cache client that uses an in-memory dict."""
+    store: dict = {}
+
+    class FakeRedis:
+        def get(self, key):
+            return store.get(key)
+
+        def set(self, key, value, ex=None):
+            store[key] = value
+
+        def delete(self, key):
+            store.pop(key, None)
+
+        def ping(self):
+            return True
+
+    client = FakeRedis()
+    monkeypatch.setattr("src.app.cache.get_cache_client", lambda: client)
+    return client

csrd_utils-0.3.16/src/csrd_utils/features/caching/docker-compose.fragment.yaml

@@ -0,0 +1,10 @@
+services:
+  redis:
+    image: redis:7-alpine
+    ports:
+      - "6379:6379"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 5

csrd_utils-0.3.16/src/csrd_utils/features/caching/manifest.yaml

@@ -0,0 +1,22 @@
+name: caching
+description: Adds Redis-backed caching with a shared cache client and settings
+
+requires:
+  dependencies:
+    - redis
+  external_services:
+    - redis
+  settings:
+    - CACHE_HOST
+    - CACHE_PORT
+    - CACHE_TTL
+
+modifies:
+  - requirements.txt
+  - docker-compose.yml
+  - src/app/settings.py
+  - tests/conftest.py
+
+creates:
+  - src/app/cache.py
+  - tests/test_cache.py

csrd_utils-0.3.16/src/csrd_utils/features/caching/requirements.fragment

@@ -0,0 +1 @@
+redis>=5.0.0

csrd_utils-0.3.16/src/csrd_utils/features/caching/settings.fragment.py

@@ -0,0 +1,4 @@
+# [INSERT: fields]
+cache_host: str = "localhost"
+cache_port: int = 6379
+cache_ttl: int = 300  # seconds