granny-devops 0.12.1__tar.gz → 0.14.0__tar.gz

{granny_devops-0.12.1 → granny_devops-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: granny-devops
-Version: 0.12.1
+Version: 0.14.0
 Summary: Cloud tools collection -- AWS infrastructure, CDN, and DevOps automation
 Author-email: Martin Wieser <martin.wieser@pseekoo.com>
 License: MIT License
@@ -301,10 +301,13 @@ granny authentik add-user-to-group user@example.com     # defaults to dash_admin
 granny authentik api GET /api/v3/core/users/me/        # generic escape hatch
 
 # Zitadel admin (self-hosted OIDC server — same shape as authentik)
-#   Point granny at your Zitadel: set ZITADEL_DOMAIN + a machine credential:
+#   ZITADEL_DOMAIN  (e.g. https://id.example.com) — plain config, NOT a secret;
+#     set it via env or .env/.deploy.env (granny auto-loads those). Not vaulted.
+#   Plus one machine credential:
 #     ZITADEL_API_TOKEN  (a PAT, used as a bearer), OR
 #     ZITADEL_SA_KEY / ZITADEL_SA_KEY_FILE  (service-account key JSON; JWT-profile auth)
-#   Vault keys (with the [vault] extra): granny/infra/zitadel-domain, -api-token, -sa-key
+#   Secret vault keys (with the [vault] extra): granny/infra/zitadel-api-token, -sa-key
+#   Mint a PAT reproducibly:  granny zitadel create-pat iam-admin --expiration 2027-06-27T00:00:00Z
 granny zitadel create-project platform
 granny zitadel create-oidc-app platform my-app \
   --redirect-uri https://app.example.com/oidc/callback

{granny_devops-0.12.1 → granny_devops-0.14.0}/README.md

@@ -168,10 +168,13 @@ granny authentik add-user-to-group user@example.com     # defaults to dash_admin
 granny authentik api GET /api/v3/core/users/me/        # generic escape hatch
 
 # Zitadel admin (self-hosted OIDC server — same shape as authentik)
-#   Point granny at your Zitadel: set ZITADEL_DOMAIN + a machine credential:
+#   ZITADEL_DOMAIN  (e.g. https://id.example.com) — plain config, NOT a secret;
+#     set it via env or .env/.deploy.env (granny auto-loads those). Not vaulted.
+#   Plus one machine credential:
 #     ZITADEL_API_TOKEN  (a PAT, used as a bearer), OR
 #     ZITADEL_SA_KEY / ZITADEL_SA_KEY_FILE  (service-account key JSON; JWT-profile auth)
-#   Vault keys (with the [vault] extra): granny/infra/zitadel-domain, -api-token, -sa-key
+#   Secret vault keys (with the [vault] extra): granny/infra/zitadel-api-token, -sa-key
+#   Mint a PAT reproducibly:  granny zitadel create-pat iam-admin --expiration 2027-06-27T00:00:00Z
 granny zitadel create-project platform
 granny zitadel create-oidc-app platform my-app \
   --redirect-uri https://app.example.com/oidc/callback

{granny_devops-0.12.1 → granny_devops-0.14.0}/granny/__init__.py

@@ -1,19 +1,19 @@
-"""Granny -- Cloud tools collection for AWS infrastructure and DevOps automation."""
-
-__version__ = "0.12.1"
-__all__ = [
-    "get_secret",
-    "load_secrets_into_env",
-]
-
-
-def __getattr__(name: str):
-    if name == "get_secret":
-        from granny.credentials.secrets import get_secret
-
-        return get_secret
-    if name == "load_secrets_into_env":
-        from granny.credentials.secrets import load_secrets_into_env
-
-        return load_secrets_into_env
-    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+"""Granny -- Cloud tools collection for AWS infrastructure and DevOps automation."""
+
+__version__ = "0.14.0"
+__all__ = [
+    "get_secret",
+    "load_secrets_into_env",
+]
+
+
+def __getattr__(name: str):
+    if name == "get_secret":
+        from granny.credentials.secrets import get_secret
+
+        return get_secret
+    if name == "load_secrets_into_env":
+        from granny.credentials.secrets import load_secrets_into_env
+
+        return load_secrets_into_env
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

{granny_devops-0.12.1 → granny_devops-0.14.0}/granny/cli/dns.py

@@ -43,16 +43,19 @@ def _split_fqdn(value: str, domain: str | None) -> tuple[str, str]:
 
     if "." in value:
         value_lower = value.lower()
-        if domain and value_lower != domain and not value_lower.endswith(f".{domain}"):
-            raise click.UsageError(
-                f"{value!r} is not under domain {domain!r}"
-            )
         if domain is None:
             return ("@", value_lower)
         if value_lower == domain:
             return ("@", domain)
-        short = value_lower[: -(len(domain) + 1)]
-        return (short, domain)
+        if value_lower.endswith(f".{domain}"):
+            short = value_lower[: -(len(domain) + 1)]
+            return (short, domain)
+        # A dotted name that's neither the zone apex nor a FQDN under it.
+        # With an explicit --domain this is a multi-label *relative* subname
+        # (e.g. ``_smtp._tls`` or ``v1-rsa-20260629._domainkey``), so treat it
+        # as relative to the zone rather than rejecting it. The resulting FQDN
+        # is echoed back, so a genuine wrong-domain typo stays visible.
+        return (value_lower, domain)
 
     # Bare label — needs a domain.
     if not domain:

{granny_devops-0.12.1 → granny_devops-0.14.0}/granny/cli/email.py

@@ -330,3 +330,122 @@ def workmail_reset_password(
         raise click.ClickException(f"User not found: {user_email}")
     wm.reset_password(org_id, user["Id"], password)
     click.echo(f"Password reset for {user_email}.")
+
+
+# -- Stalwart subgroup --------------------------------------------------------
+
+
+@email.group("stalwart")
+def stalwart() -> None:
+    """Stalwart mail server admin (domains, mailboxes, DNS, delivery test)."""
+
+
+@stalwart.command("list-domains")
+def stalwart_list_domains() -> None:
+    """List configured local domains."""
+    from granny.email.stalwart import StalwartClient
+
+    c = StalwartClient.from_environment()
+    domains = c.list_domains()
+    if not domains:
+        click.echo("No domains configured.")
+        return
+    for d in domains:
+        dkim = (d.get("dkimManagement") or {}).get("@type", "?")
+        click.echo(
+            f"  {d.get('id', '?'):<5} {d.get('name', '?'):<30} "
+            f"enabled={d.get('isEnabled')}  dkim={dkim}"
+        )
+
+
+@stalwart.command("add-domain")
+@click.argument("name")
+def stalwart_add_domain(name: str) -> None:
+    """Create a new local domain (Manual cert, Automatic DKIM, Manual DNS)."""
+    from granny.email.stalwart import StalwartClient
+
+    c = StalwartClient.from_environment()
+    created = c.add_domain(name)
+    click.echo(f"Domain {name} ready (id={created.get('id')})")
+    click.echo(f"Next: granny email stalwart show-dns {name}")
+
+
+@stalwart.command("list-mailboxes")
+def stalwart_list_mailboxes() -> None:
+    """List individual mailboxes."""
+    from granny.email.stalwart import StalwartClient
+
+    c = StalwartClient.from_environment()
+    mailboxes = c.list_mailboxes()
+    if not mailboxes:
+        click.echo("No mailboxes configured.")
+        return
+    for a in mailboxes:
+        role = (a.get("roles") or {}).get("@type", "?")
+        click.echo(
+            f"  {a.get('id', '?'):<5} {a.get('emailAddress', '?'):<40} role={role}"
+        )
+
+
+@stalwart.command("add-mailbox")
+@click.argument("email_address")
+@click.option("--description", default=None, help="Free-text mailbox description.")
+@click.option(
+    "--password",
+    default=None,
+    help="Use this password instead of generating one (NOT recommended).",
+)
+def stalwart_add_mailbox(
+    email_address: str, description: str | None, password: str | None,
+) -> None:
+    """Create a mailbox under an existing local domain.
+
+    The generated password is shown ONCE on stdout. Save it immediately
+    (e.g. into Vaultwarden) — Stalwart hashes it server-side.
+    """
+    from granny.email.stalwart import StalwartClient
+
+    c = StalwartClient.from_environment()
+    record, generated = c.add_mailbox(
+        email_address, password=password, description=description,
+    )
+    click.echo(f"Mailbox created (id={record.get('id')})")
+    click.echo("")
+    click.echo(f"  Email:    {email_address}")
+    click.echo(f"  Password: {generated}")
+    click.echo("")
+    base = c.base_url.removeprefix("https://").removeprefix("http://")
+    click.echo(f"  SMTP submission: {base}:587 (STARTTLS) or :465 (implicit TLS)")
+    click.echo(f"  IMAP:            {base}:993")
+    click.echo(f"  JMAP / WebDAV:   {c.base_url}/")
+    click.echo("")
+    click.echo("  This password is shown ONCE — save it now.")
+
+
+@stalwart.command("show-dns")
+@click.argument("name")
+def stalwart_show_dns(name: str) -> None:
+    """Print Stalwart's generated DNS zone for a domain.
+
+    Output is in BIND zone-file syntax (SPF, MX, DKIM, DMARC, MTA-STS,
+    TLS-RPT, SRV autoconfig). Publish at the domain's registrar.
+    """
+    from granny.email.stalwart import StalwartClient
+
+    c = StalwartClient.from_environment()
+    click.echo(c.get_dns_zone(name))
+
+
+@stalwart.command("delivery-test")
+@click.argument("recipient")
+def stalwart_delivery_test(recipient: str) -> None:
+    """Stream Stalwart's live deliverability report for one recipient.
+
+    Mirrors the admin UI's *Live Delivery Test* page (MX lookup,
+    MTA-STS, TLS-RPT, banner, STARTTLS, etc.).
+    """
+    from granny.email.stalwart import StalwartClient
+
+    c = StalwartClient.from_environment()
+    for line in c.stream_delivery_test(recipient):
+        click.echo(line)

{granny_devops-0.12.1 → granny_devops-0.14.0}/granny/cli/zitadel.py

@@ -275,19 +275,61 @@ def delete_user_cmd(user: str, dry_run: bool) -> None:
     click.echo(json.dumps({"user": user, "deleted": True}, indent=2))
 
 
+# ── personal access tokens ─────────────────────────────────────────────────
+
+
+@zitadel.command("create-pat")
+@click.argument("user")
+@click.option(
+    "--expiration",
+    default=None,
+    help="RFC3339 expiry, e.g. 2027-06-27T00:00:00Z (omit for non-expiring).",
+)
+@click.option("--dry-run", is_flag=True, help="Change nothing.")
+def create_pat_cmd(user: str, expiration: str | None, dry_run: bool) -> None:
+    """Mint a personal access token for machine USER (userName or id).
+
+    Prints {tokenId, token}. The token is shown ONCE — capture it and store it
+    at vault `granny/infra/zitadel-api-token` (or export ZITADEL_API_TOKEN).
+    """
+    if dry_run:
+        click.echo(f"[DRY RUN] Would create a PAT for {user!r} (expiration={expiration})")
+        return
+    client = _client()
+    out = client.create_pat(_resolve_user(client, user), expiration_date=expiration)
+    click.echo(json.dumps({"tokenId": out.get("tokenId"), "token": out.get("token")}, indent=2))
+
+
+@zitadel.command("revoke-pat")
+@click.argument("user")
+@click.argument("token_id")
+@click.option("--dry-run", is_flag=True, help="Change nothing.")
+def revoke_pat_cmd(user: str, token_id: str, dry_run: bool) -> None:
+    """Revoke PAT TOKEN_ID belonging to machine USER (userName or id)."""
+    if dry_run:
+        click.echo(f"[DRY RUN] Would revoke PAT {token_id} of {user!r}")
+        return
+    client = _client()
+    client.delete_pat(_resolve_user(client, user), token_id)
+    click.echo(json.dumps({"user": user, "tokenId": token_id, "revoked": True}, indent=2))
+
+
 # ── list ─────────────────────────────────────────────────────────────────
 
 
 @zitadel.command("list")
-@click.argument("kind", type=click.Choice(["users", "projects", "apps", "roles"]))
+@click.argument("kind", type=click.Choice(["users", "projects", "apps", "roles", "pats"]))
 @click.option(
     "--project", default=None, help="Project (id or name) — required for apps/roles."
 )
+@click.option(
+    "--user", default=None, help="User (userName or id) — required for pats."
+)
 @click.option(
     "--json", "as_json", is_flag=True, help="Emit full JSON instead of a table."
 )
-def list_cmd(kind: str, project: str | None, as_json: bool) -> None:
-    """List Zitadel objects of KIND (users | projects | apps | roles)."""
+def list_cmd(kind: str, project: str | None, user: str | None, as_json: bool) -> None:
+    """List Zitadel objects of KIND (users | projects | apps | roles | pats)."""
     client = _client()
     if kind == "users":
         rows = client.list_users()
@@ -295,6 +337,12 @@ def list_cmd(kind: str, project: str | None, as_json: bool) -> None:
     elif kind == "projects":
         rows = client.list_projects()
         cols = ("id", "name", "state")
+    elif kind == "pats":
+        if not user:
+            click.echo("--user is required for `list pats`", err=True)
+            sys.exit(1)
+        rows = client.list_pats(_resolve_user(client, user))
+        cols = ("id", "expirationDate", "creationDate")
     else:
         if not project:
             click.echo(f"--project is required for `list {kind}`", err=True)

{granny_devops-0.12.1 → granny_devops-0.14.0}/granny/credentials/secrets.py

@@ -172,15 +172,22 @@ SECRET_MAP: dict[str, str] = {
     # superuser-issued token (Authentik UI → Directory → Tokens). Falls back
     # to AK_TOKEN env var in granny.authentik.AuthentikClient.from_environment.
     "AUTHENTIK_API_TOKEN": "authentik-api-token",
-    # Zitadel OIDC server (`granny zitadel …`): the IdP base URL, an optional
-    # PAT, and the service-account key JSON used for JWT-profile machine auth.
-    "ZITADEL_DOMAIN": "zitadel-domain",
+    # Zitadel OIDC server (`granny zitadel …`): an optional PAT and the
+    # service-account key JSON used for JWT-profile machine auth. The IdP base
+    # URL (ZITADEL_DOMAIN) is plain config, NOT a secret — set it via env /
+    # .env / .deploy.env, so it is deliberately not mapped to the vault.
     "ZITADEL_API_TOKEN": "zitadel-api-token",
     "ZITADEL_SA_KEY": "zitadel-sa-key",
     # Elasticsearch / Kibana security API credentials for `granny elk …`.
     "ELASTICSEARCH_API_KEY": "elasticsearch-api-key",
     "ELASTICSEARCH_USERNAME": "elasticsearch-username",
     "ELASTICSEARCH_PASSWORD": "elasticsearch-password",
+    # Stalwart mail server admin (Basic auth on JMAP / REST). The username is
+    # not secret but is registered alongside the password so both can come from
+    # the same vault item. Base URL defaults to https://mail.pseekoo.io in
+    # StalwartClient.from_environment() and is overridable via STALWART_URL.
+    "STALWART_ADMIN_USER": "stalwart-admin-user",
+    "STALWART_ADMIN_PASSWORD": "stalwart-admin-password",
 }
 
 # Module-level cache so vault is only contacted once per process

{granny_devops-0.12.1 → granny_devops-0.14.0}/granny/dns/bunny.py

@@ -107,7 +107,7 @@ class BunnyDNSProvider(DNSProvider):
                 DNSRecord(
                     name=rec.get("Name", "") or "",
                     type=RECORD_TYPE_NAMES.get(rec.get("Type", -1), "?"),
-                    value=rec.get("Value", ""),
+                    value=self._record_value(rec),
                     ttl=int(rec.get("Ttl", 300)),
                     id=str(rec.get("Id")),
                     provider_data=rec,
@@ -124,27 +124,79 @@ class BunnyDNSProvider(DNSProvider):
         ttl: int = 300,
         proxied: bool = False,
     ) -> DNSRecord:
-        type_num = RECORD_TYPES.get(record_type.upper())
+        rtype = record_type.upper()
+        type_num = RECORD_TYPES.get(rtype)
         if type_num is None:
             raise ValueError(f"Unknown record type: {record_type}")
         short_name = "" if name in ("@", None) else name
+        record_value = value.rstrip(".") if rtype == "CNAME" else value
+        priority: int | None = None
+        extra: dict[str, int] = {}
+        if rtype == "MX":
+            # BIND-style "10 mail.example.com" → Priority + target.
+            head, _, tail = value.strip().partition(" ")
+            if head.isdigit() and tail:
+                priority = int(head)
+                record_value = tail.rstrip(".")
+        elif rtype == "SRV":
+            # BIND-style "priority weight port target" → Bunny's separate
+            # Priority/Weight/Port fields plus Value=target.
+            parts = value.split()
+            if len(parts) != 4:
+                raise ValueError(
+                    f"SRV value must be 'priority weight port target', got {value!r}"
+                )
+            prio, weight, port, target = parts
+            priority = int(prio)
+            extra = {"Weight": int(weight), "Port": int(port)}
+            record_value = target.rstrip(".")
         payload = {
             "Type": type_num,
             "Name": short_name,
-            "Value": value.rstrip(".") if record_type.upper() == "CNAME" else value,
+            "Value": record_value,
             "Ttl": ttl,
         }
+        if priority is not None:
+            payload["Priority"] = priority
+        payload.update(extra)
         result = self._request("PUT", f"/dnszone/{zone_id}/records", payload)
         logger.info("Bunny DNS: created %s %s -> %s", record_type, short_name, value)
+        # Build the display value from what we sent — Bunny's create response
+        # doesn't reliably echo Priority/Weight/Port back.
+        if rtype == "MX" and priority is not None:
+            display_value = f"{priority} {record_value}"
+        elif rtype == "SRV":
+            display_value = f"{priority} {extra['Weight']} {extra['Port']} {record_value}"
+        else:
+            display_value = record_value
         return DNSRecord(
             name=short_name,
-            type=record_type.upper(),
-            value=payload["Value"],
+            type=rtype,
+            value=display_value,
             ttl=ttl,
             id=str(result.get("Id")) if isinstance(result, dict) else None,
             provider_data=result if isinstance(result, dict) else {},
         )
 
+    @staticmethod
+    def _record_value(rec: dict) -> str:
+        """Reconstruct a BIND-style value from a Bunny record.
+
+        MX prepends ``Priority``; SRV expands to ``priority weight port
+        target``. Keeps round-tripped values in the same shape callers pass,
+        so ``upsert_record`` compares equal and stays idempotent.
+        """
+        value = rec.get("Value", "") or ""
+        rtype = rec.get("Type")
+        if rtype == RECORD_TYPES["MX"]:
+            return f"{rec.get('Priority', 0)} {value}".strip()
+        if rtype == RECORD_TYPES["SRV"]:
+            return (
+                f"{rec.get('Priority', 0)} {rec.get('Weight', 0)} "
+                f"{rec.get('Port', 0)} {value}"
+            )
+        return value
+
     def delete_record(self, zone_id: str, record_id: str) -> None:
         self._request("DELETE", f"/dnszone/{zone_id}/records/{record_id}")
         logger.info("Bunny DNS: deleted record %s", record_id)

{granny_devops-0.12.1 → granny_devops-0.14.0}/granny/dns/cloudflare.py

@@ -101,7 +101,7 @@ class CloudflareDNSProvider(DNSProvider):
                 DNSRecord(
                     name=rec.get("name", ""),
                     type=rec.get("type", ""),
-                    value=rec.get("content", ""),
+                    value=self._record_value(rec),
                     ttl=int(rec.get("ttl", 300)),
                     id=rec.get("id"),
                     fqdn=rec.get("name"),
@@ -110,6 +110,61 @@ class CloudflareDNSProvider(DNSProvider):
             )
         return out
 
+    @staticmethod
+    def _record_value(rec: dict) -> str:
+        """Reconstruct a BIND-style value string from a Cloudflare record.
+
+        MX prepends its ``priority``; SRV expands its ``data`` object to
+        ``priority weight port target``. Everything else uses ``content``.
+        Keeping the round-tripped value in this shape lets ``upsert_record``
+        compare against the value callers pass and stay idempotent.
+        """
+        rtype = rec.get("type", "")
+        content = rec.get("content", "") or ""
+        if rtype == "MX" and rec.get("priority") is not None:
+            return f"{rec['priority']} {content}".strip()
+        if rtype == "SRV":
+            data = rec.get("data") or {}
+            if data:
+                return (
+                    f"{data.get('priority', 0)} {data.get('weight', 0)} "
+                    f"{data.get('port', 0)} {str(data.get('target', '')).rstrip('.')}"
+                )
+        return content
+
+    @staticmethod
+    def _type_payload(record_type: str, value: str) -> dict:
+        """Build the type-specific Cloudflare payload fields.
+
+        MX and SRV can't be expressed with a bare ``content`` string —
+        Cloudflare requires a separate ``priority`` (MX) or a structured
+        ``data`` object (SRV). Both accept the BIND-style value granny passes
+        around: ``"10 mail.example.com"`` for MX and
+        ``"0 1 443 mail.example.com"`` (priority weight port target) for SRV.
+        A bare MX target defaults to priority 10.
+        """
+        rtype = record_type.upper()
+        parts = value.split()
+        if rtype == "MX":
+            if len(parts) == 2 and parts[0].isdigit():
+                return {"content": parts[1].rstrip("."), "priority": int(parts[0])}
+            return {"content": value.rstrip("."), "priority": 10}
+        if rtype == "SRV":
+            if len(parts) != 4:
+                raise ValueError(
+                    f"SRV value must be 'priority weight port target', got {value!r}"
+                )
+            prio, weight, port, target = parts
+            return {
+                "data": {
+                    "priority": int(prio),
+                    "weight": int(weight),
+                    "port": int(port),
+                    "target": target.rstrip("."),
+                }
+            }
+        return {"content": value}
+
     def get_record(
         self, zone_id: str, name: str, record_type: str
     ) -> DNSRecord | None:
@@ -134,20 +189,22 @@ class CloudflareDNSProvider(DNSProvider):
         payload = {
             "type": record_type.upper(),
             "name": fqdn,
-            "content": value,
             # Cloudflare uses ttl=1 as the sentinel for "automatic". Anything
             # else must be >= 60. Match manage-dns.sh's behavior: if caller
             # passes ttl<=1, use automatic; otherwise send the value.
             "ttl": 1 if ttl <= 1 else ttl,
             "proxied": proxied,
         }
+        # MX needs a separate `priority`, SRV a structured `data` object;
+        # everything else is a plain `content` string.
+        payload.update(self._type_payload(record_type, value))
         body = self._request("POST", f"/zones/{zone_id}/dns_records", json=payload)
         rec = body.get("result") or {}
         logger.info("Cloudflare: created %s %s -> %s", record_type, fqdn, value)
         return DNSRecord(
             name=rec.get("name", fqdn),
             type=rec.get("type", record_type.upper()),
-            value=rec.get("content", value),
+            value=self._record_value(rec) or value,
             ttl=int(rec.get("ttl", ttl)),
             id=rec.get("id"),
             fqdn=rec.get("name", fqdn),
@@ -168,10 +225,10 @@ class CloudflareDNSProvider(DNSProvider):
         payload = {
             "type": record_type.upper(),
             "name": fqdn,
-            "content": value,
             "ttl": 1 if ttl <= 1 else ttl,
             "proxied": proxied,
         }
+        payload.update(self._type_payload(record_type, value))
         body = self._request(
             "PUT", f"/zones/{zone_id}/dns_records/{record_id}", json=payload
         )
@@ -180,7 +237,7 @@ class CloudflareDNSProvider(DNSProvider):
         return DNSRecord(
             name=rec.get("name", fqdn),
             type=rec.get("type", record_type.upper()),
-            value=rec.get("content", value),
+            value=self._record_value(rec) or value,
             ttl=int(rec.get("ttl", ttl)),
             id=rec.get("id", record_id),
             fqdn=rec.get("name", fqdn),

granny_devops-0.14.0/granny/email/__init__.py

@@ -0,0 +1,14 @@
+"""Email management — Mailjet, AWS WorkMail, Stalwart."""
+
+from granny.email.mailjet import MailjetClient
+from granny.email.mailjet_contacts import MailjetContactClient
+from granny.email.stalwart import StalwartClient, StalwartError
+from granny.email.workmail import WorkMailManager
+
+__all__ = [
+    "MailjetClient",
+    "MailjetContactClient",
+    "StalwartClient",
+    "StalwartError",
+    "WorkMailManager",
+]