granny-devops 0.15.0__tar.gz → 0.17.0__tar.gz

{granny_devops-0.15.0 → granny_devops-0.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: granny-devops
-Version: 0.15.0
+Version: 0.17.0
 Summary: Cloud tools collection -- AWS infrastructure, CDN, and DevOps automation
 Author-email: Martin Wieser <martin.wieser@pseekoo.com>
 License: MIT License
@@ -26,6 +26,7 @@ License: MIT License
         SOFTWARE.
 License-File: LICENSE
 Requires-Python: >=3.13
+Requires-Dist: acme>=2.11
 Requires-Dist: boto3>=1.38
 Requires-Dist: click>=8.1
 Requires-Dist: pyjwt[crypto]>=2.8
@@ -257,6 +258,10 @@ granny storage aws create my-website --website
 granny analyze vpcs --json-output
 granny analyze lambdas --region us-east-1 eu-west-1
 
+# AWS Bedrock -- foundation models (read-only; on-demand access auto-enables on first invoke)
+granny aws bedrock list-models --profile lularge --region eu-central-1 --by-provider Anthropic
+granny aws bedrock check-access --model-id anthropic.claude-sonnet-4-20250514-v1:0 --profile lularge --region eu-central-1
+
 # Cross-cloud GPU / credit / cost inventory (AWS + GCP + Azure)
 granny analyze gpus                                # running GPUs everywhere
 granny analyze gpus --filter h100,h200             # find Hopper clusters
@@ -288,6 +293,10 @@ granny email workmail create-user example.com --email user@example.com
 granny create s3-website example.com --help
 granny create scaleway-container --name my-app --port 3000
 granny create mailjet-dns example.com
+granny create letsencrypt-cert \
+  --domain '*.example.com' --domain example.com \
+  --dns inwx --zone example.com \
+  --email ops@example.com --out-dir ./certs   # real LE cert via ACME dns-01, any granny DNS provider
 
 # Authentik admin (provider + application + group plumbing)
 granny authentik provision-oauth-app my-app \
@@ -311,6 +320,9 @@ granny authentik api GET /api/v3/core/users/me/        # generic escape hatch
 granny zitadel create-project platform
 granny zitadel create-oidc-app platform my-app \
   --redirect-uri https://app.example.com/oidc/callback
+granny zitadel set-redirect-uris --project platform --app my-app \
+  --redirect-uri https://app.example.com/oidc/callback \
+  --redirect-uri https://app.example.com/oidc/callback2   # merges by default; --replace to set exactly
 granny zitadel rotate-secret platform my-app
 granny zitadel create-user alice --email alice@example.com --password 's3cret'
 granny zitadel ensure-role platform admin                 # Zitadel uses project roles, not groups
@@ -329,8 +341,15 @@ granny elk add-user user@example.com \
 granny azure account whoami                                  # signed-in identity
 granny azure account list                                    # subscriptions
 granny azure deployment list --subscription <id> --all-groups
+granny azure group create --subscription <id> --name <rg> --location swedencentral
 granny azure openai accounts --subscription <id>
-granny azure openai deployments --subscription <id> --kind OpenAI
+granny azure openai account create --subscription <id> --resource-group <rg> \
+    --name <acct> --location swedencentral                   # create an Azure OpenAI account
+granny azure openai keys --subscription <id> --resource-group <rg> --account <acct>
+granny azure openai deployments --subscription <id> --kind OpenAI --with-usage  # + created_at & last-used (Azure Monitor)
+granny azure openai deployment create --subscription <id> --resource-group <rg> \
+    --account <acct> --name gpt-5.4 --model gpt-5.4 --model-version 2026-03-05 \
+    --sku GlobalStandard --capacity 50                       # create a model deployment
 granny azure webapp list --subscription <id>
 granny azure vm-sizes list --subscription <id> --location polandcentral
 granny azure vm list --subscription <id>                      # running VMs + power state
@@ -359,7 +378,7 @@ granny indexing google https://example.com/job-posting --action URL_UPDATED
 | Email send infra | Mailjet, AWS SES, AWS WorkMail |
 | AWS inventory | VPCs, Lambdas |
 | Cross-cloud inventory | GPU instances + reservations, credit balances, MTD spend + forecast (AWS, GCP, Azure) |
-| SSL automation | Bunny, Cloudflare, ACM |
+| SSL automation | Bunny, Cloudflare, ACM, Let's Encrypt (ACME dns-01 over any granny DNS provider) |
 | SSO / IdP | Authentik (provider, application, group, and user operations) |
 | Observability admin | Elasticsearch / Kibana native-user management |
 | Azure ops | Identity, subscriptions, ARM deployments, Cognitive Services (Azure OpenAI), App Service, VM sizes, VM inventory/deallocate/delete, RBAC role assignment, compute quota |

{granny_devops-0.15.0 → granny_devops-0.17.0}/README.md

@@ -124,6 +124,10 @@ granny storage aws create my-website --website
 granny analyze vpcs --json-output
 granny analyze lambdas --region us-east-1 eu-west-1
 
+# AWS Bedrock -- foundation models (read-only; on-demand access auto-enables on first invoke)
+granny aws bedrock list-models --profile lularge --region eu-central-1 --by-provider Anthropic
+granny aws bedrock check-access --model-id anthropic.claude-sonnet-4-20250514-v1:0 --profile lularge --region eu-central-1
+
 # Cross-cloud GPU / credit / cost inventory (AWS + GCP + Azure)
 granny analyze gpus                                # running GPUs everywhere
 granny analyze gpus --filter h100,h200             # find Hopper clusters
@@ -155,6 +159,10 @@ granny email workmail create-user example.com --email user@example.com
 granny create s3-website example.com --help
 granny create scaleway-container --name my-app --port 3000
 granny create mailjet-dns example.com
+granny create letsencrypt-cert \
+  --domain '*.example.com' --domain example.com \
+  --dns inwx --zone example.com \
+  --email ops@example.com --out-dir ./certs   # real LE cert via ACME dns-01, any granny DNS provider
 
 # Authentik admin (provider + application + group plumbing)
 granny authentik provision-oauth-app my-app \
@@ -178,6 +186,9 @@ granny authentik api GET /api/v3/core/users/me/        # generic escape hatch
 granny zitadel create-project platform
 granny zitadel create-oidc-app platform my-app \
   --redirect-uri https://app.example.com/oidc/callback
+granny zitadel set-redirect-uris --project platform --app my-app \
+  --redirect-uri https://app.example.com/oidc/callback \
+  --redirect-uri https://app.example.com/oidc/callback2   # merges by default; --replace to set exactly
 granny zitadel rotate-secret platform my-app
 granny zitadel create-user alice --email alice@example.com --password 's3cret'
 granny zitadel ensure-role platform admin                 # Zitadel uses project roles, not groups
@@ -196,8 +207,15 @@ granny elk add-user user@example.com \
 granny azure account whoami                                  # signed-in identity
 granny azure account list                                    # subscriptions
 granny azure deployment list --subscription <id> --all-groups
+granny azure group create --subscription <id> --name <rg> --location swedencentral
 granny azure openai accounts --subscription <id>
-granny azure openai deployments --subscription <id> --kind OpenAI
+granny azure openai account create --subscription <id> --resource-group <rg> \
+    --name <acct> --location swedencentral                   # create an Azure OpenAI account
+granny azure openai keys --subscription <id> --resource-group <rg> --account <acct>
+granny azure openai deployments --subscription <id> --kind OpenAI --with-usage  # + created_at & last-used (Azure Monitor)
+granny azure openai deployment create --subscription <id> --resource-group <rg> \
+    --account <acct> --name gpt-5.4 --model gpt-5.4 --model-version 2026-03-05 \
+    --sku GlobalStandard --capacity 50                       # create a model deployment
 granny azure webapp list --subscription <id>
 granny azure vm-sizes list --subscription <id> --location polandcentral
 granny azure vm list --subscription <id>                      # running VMs + power state
@@ -226,7 +244,7 @@ granny indexing google https://example.com/job-posting --action URL_UPDATED
 | Email send infra | Mailjet, AWS SES, AWS WorkMail |
 | AWS inventory | VPCs, Lambdas |
 | Cross-cloud inventory | GPU instances + reservations, credit balances, MTD spend + forecast (AWS, GCP, Azure) |
-| SSL automation | Bunny, Cloudflare, ACM |
+| SSL automation | Bunny, Cloudflare, ACM, Let's Encrypt (ACME dns-01 over any granny DNS provider) |
 | SSO / IdP | Authentik (provider, application, group, and user operations) |
 | Observability admin | Elasticsearch / Kibana native-user management |
 | Azure ops | Identity, subscriptions, ARM deployments, Cognitive Services (Azure OpenAI), App Service, VM sizes, VM inventory/deallocate/delete, RBAC role assignment, compute quota |

{granny_devops-0.15.0 → granny_devops-0.17.0}/granny/__init__.py

@@ -1,6 +1,6 @@
 """Granny -- Cloud tools collection for AWS infrastructure and DevOps automation."""
 
-__version__ = "0.15.0"
+__version__ = "0.17.0"
 __all__ = [
     "get_secret",
     "load_secrets_into_env",

{granny_devops-0.15.0 → granny_devops-0.17.0}/granny/cli/create.py

@@ -33,6 +33,7 @@ COMMANDS: dict[str, str] = {
     "scaleway-container": "setup_scaleway_container.py",
     "workmail": "setup_workmail.py",
     "auto-certificate": "auto_certificate.py",
+    "letsencrypt-cert": "letsencrypt_cert.py",
     "mailjet-contacts": "manage_mailjet_contacts.py",
 }
 

{granny_devops-0.15.0 → granny_devops-0.17.0}/granny/cli/zitadel.py

@@ -128,6 +128,68 @@ def create_oidc_app_cmd(
     )
 
 
+@zitadel.command("set-redirect-uris")
+@click.option("--project", required=True, help="Project name or id owning the app.")
+@click.option("--app", "app_name", required=True, help="OIDC app name.")
+@click.option(
+    "--redirect-uri",
+    "redirect_uris",
+    multiple=True,
+    required=True,
+    help="Allowed OIDC redirect URI (repeatable).",
+)
+@click.option(
+    "--post-logout-uri",
+    "post_logout_uris",
+    multiple=True,
+    help="Post-logout redirect URI to add (repeatable).",
+)
+@click.option(
+    "--replace",
+    is_flag=True,
+    help="Replace the redirect-URI set instead of merging with the existing one.",
+)
+@click.option("--dry-run", is_flag=True)
+def set_redirect_uris_cmd(
+    project: str,
+    app_name: str,
+    redirect_uris: tuple[str, ...],
+    post_logout_uris: tuple[str, ...],
+    replace: bool,
+    dry_run: bool,
+) -> None:
+    """Set an existing OIDC app's allowed redirect URIs (idempotent).
+
+    Merges with the app's current redirect URIs by default (union, de-duped),
+    so re-running with the same set is a no-op. Use ``--replace`` to set exactly
+    the URIs given.
+    """
+    client = _client()
+    found = client.find_project(project)
+    project_id = found["id"] if found else project
+    app = client.find_oidc_app(project_id, app_name)
+    if not app:
+        raise click.ClickException(
+            f"OIDC app {app_name!r} not found in project {project!r}"
+        )
+    app_id = app.get("id")
+    if dry_run:
+        verb = "replace with" if replace else "merge in"
+        click.echo(
+            f"[DRY RUN] Would {verb} redirect URIs on app {app_name!r} "
+            f"({app_id}): {list(redirect_uris)}"
+        )
+        return
+    result = client.set_oidc_app_redirects(
+        project_id,
+        app_id,  # type: ignore[arg-type]
+        list(redirect_uris),
+        replace=replace,
+        post_logout_uris=list(post_logout_uris),
+    )
+    click.echo(json.dumps(result, indent=2))
+
+
 @zitadel.command("enforce-mfa")
 @click.option(
     "--no-passkey",

granny_devops-0.17.0/granny/create/letsencrypt_cert.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+"""Let's Encrypt certificate issuance via ACME DNS-01, driven by granny's DNS
+providers.
+
+Unlike ``auto_certificate.py`` (AWS ACM / Bunny), this issues a real
+Let's Encrypt certificate (fullchain + private key PEM) usable by Caddy,
+nginx, Kubernetes Secrets, etc. The ACME ``dns-01`` challenge is solved by
+creating ``_acme-challenge`` TXT records through **any** granny DNS provider
+(``--dns inwx`` / ``cloudflare`` / ``hetzner`` / ...), so it works for zones
+like ``obachan.dev`` (INWX) where no cert-manager webhook exists.
+
+Example::
+
+    granny create letsencrypt-cert \\
+        --domain '*.obachan.dev' --domain obachan.dev \\
+        --dns inwx --zone obachan.dev \\
+        --email ops@example.com --out-dir ./certs
+
+Credentials for the DNS provider resolve through granny's normal vault/env
+pipeline (e.g. INWX_USERNAME / INWX_PASSWORD / INWX_SHARED_SECRET).
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+import time
+from pathlib import Path
+
+import requests
+
+try:  # granny's vault→env pipeline (same as auto_certificate.py)
+    from granny.credentials import load_secrets_into_env
+
+    load_secrets_into_env()
+except Exception:  # pragma: no cover - best effort
+    pass
+
+_LE_PROD = "https://acme-v02.api.letsencrypt.org/directory"
+_LE_STAGING = "https://acme-staging-v02.api.letsencrypt.org/directory"
+_DOH = "https://dns.google/resolve"
+
+
+def _new_rsa_key():  # noqa: ANN202
+    from cryptography.hazmat.primitives.asymmetric import rsa
+
+    return rsa.generate_private_key(public_exponent=65537, key_size=2048)
+
+
+def _key_pem(key) -> bytes:  # noqa: ANN001
+    from cryptography.hazmat.primitives import serialization
+
+    return key.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.TraditionalOpenSSL,
+        serialization.NoEncryption(),
+    )
+
+
+def _relative_name(fqdn: str, zone: str) -> str:
+    """Strip the trailing ``.<zone>`` so provider APIs get the short name."""
+    fqdn = fqdn.rstrip(".")
+    suffix = "." + zone.rstrip(".")
+    return fqdn[: -len(suffix)] if fqdn.endswith(suffix) else fqdn
+
+
+def _txt_propagated(fqdn: str, value: str, *, attempts: int, delay: int) -> bool:
+    """Poll public DNS (DoH) until the challenge TXT value is visible."""
+    for i in range(attempts):
+        try:
+            resp = requests.get(
+                _DOH, params={"name": fqdn, "type": "TXT"}, timeout=10
+            ).json()
+            answers = [a.get("data", "").strip('"') for a in resp.get("Answer", [])]
+            if value in answers:
+                return True
+        except Exception:  # noqa: BLE001 - transient resolver errors are fine
+            pass
+        if i < attempts - 1:
+            time.sleep(delay)
+    return False
+
+
+def issue_certificate(
+    domains: list[str],
+    *,
+    dns: str,
+    zone: str,
+    email: str,
+    staging: bool = False,
+    propagation_attempts: int = 20,
+    propagation_delay: int = 15,
+) -> tuple[str, str]:
+    """Issue a Let's Encrypt cert for ``domains``; return (fullchain_pem, key_pem).
+
+    ``dns`` is a granny DNS provider name; ``zone`` is the registrable zone the
+    challenge records live in (e.g. ``obachan.dev``).
+    """
+    import josepy as jose
+    from acme import challenges, client, crypto_util, messages
+
+    from granny.dns.factory import get_provider
+
+    provider = get_provider(dns)
+    zone_id = provider.get_zone_id(zone)
+
+    directory_url = _LE_STAGING if staging else _LE_PROD
+    account_key = jose.JWKRSA(key=_new_rsa_key())
+    net = client.ClientNetwork(account_key, user_agent="granny-letsencrypt")
+    directory = client.ClientV2.get_directory(directory_url, net)
+    acme = client.ClientV2(directory, net)
+    acme.new_account(
+        messages.NewRegistration.from_data(email=email, terms_of_service_agreed=True)
+    )
+
+    cert_key = _new_rsa_key()
+    cert_key_pem = _key_pem(cert_key)
+    csr_pem = crypto_util.make_csr(cert_key_pem, domains)
+    order = acme.new_order(csr_pem)
+
+    created: list[tuple[str, str, str]] = []  # (fqdn, value, record_id) for cleanup
+    try:
+        # 1. Publish every dns-01 TXT record first (a base domain + its wildcard
+        #    share `_acme-challenge.<domain>`, so multiple values can coexist).
+        pending = []
+        for authz in order.authorizations:
+            dom = authz.body.identifier.value
+            chall = next(
+                c for c in authz.body.challenges if isinstance(c.chall, challenges.DNS01)
+            )
+            response, validation = chall.response_and_validation(account_key)
+            fqdn = chall.chall.validation_domain_name(dom)
+            rec = provider.create_record(
+                zone_id, _relative_name(fqdn, zone), "TXT", validation
+            )
+            created.append((fqdn, validation, rec.id))
+            pending.append((fqdn, validation, chall, response))
+            print(f"  published TXT {fqdn} = {validation[:12]}…", file=sys.stderr)
+
+        # 2. Wait for propagation, then answer each challenge.
+        for fqdn, validation, chall, response in pending:
+            if not _txt_propagated(
+                fqdn, validation, attempts=propagation_attempts, delay=propagation_delay
+            ):
+                raise TimeoutError(f"TXT for {fqdn} did not propagate in time")
+            acme.answer_challenge(chall, response)
+            print(f"  answered challenge for {fqdn}", file=sys.stderr)
+
+        # 3. Finalize + download.
+        order = acme.poll_and_finalize(order)
+    finally:
+        for _fqdn, _val, rec_id in created:
+            try:
+                provider.delete_record(zone_id, rec_id)
+            except Exception:  # noqa: BLE001 - best-effort cleanup
+                pass
+
+    return order.fullchain_pem, cert_key_pem.decode("utf-8")
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Issue a Let's Encrypt cert via DNS-01.")
+    parser.add_argument("--domain", action="append", required=True, help="Domain (repeatable; wildcards ok).")
+    parser.add_argument("--dns", required=True, help="granny DNS provider (e.g. inwx, cloudflare).")
+    parser.add_argument("--zone", required=True, help="Registrable zone the challenge records live in.")
+    parser.add_argument("--email", required=True, help="ACME account contact email.")
+    parser.add_argument("--out-dir", default=".", help="Directory to write fullchain.pem + key.pem.")
+    parser.add_argument("--staging", action="store_true", help="Use the LE staging CA (no rate limits).")
+    parser.add_argument("--propagation-attempts", type=int, default=20)
+    parser.add_argument("--propagation-delay", type=int, default=15)
+    args = parser.parse_args(argv)
+
+    fullchain, key = issue_certificate(
+        args.domain,
+        dns=args.dns,
+        zone=args.zone,
+        email=args.email,
+        staging=args.staging,
+        propagation_attempts=args.propagation_attempts,
+        propagation_delay=args.propagation_delay,
+    )
+
+    out = Path(args.out_dir)
+    out.mkdir(parents=True, exist_ok=True)
+    (out / "fullchain.pem").write_text(fullchain, encoding="utf-8")
+    (out / "key.pem").write_text(key, encoding="utf-8")
+    print(f"wrote {out / 'fullchain.pem'} and {out / 'key.pem'}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{granny_devops-0.15.0 → granny_devops-0.17.0}/granny/zitadel/client.py

@@ -262,6 +262,53 @@ class ZitadelClient:
             "POST", f"/management/v1/projects/{project_id}/apps/oidc", body=body
         )
 
+    def set_oidc_app_redirects(
+        self,
+        project_id: str,
+        app_id: str,
+        redirect_uris: list[str],
+        *,
+        replace: bool = False,
+        post_logout_uris: list[str] | None = None,
+    ) -> dict[str, Any]:
+        """Set an existing OIDC app's redirect URIs (idempotent).
+
+        Reads the app's current ``oidcConfig`` and PUTs it back with the merged
+        redirect URIs (Zitadel's update endpoint replaces the whole config, so
+        every field is round-tripped). With ``replace=False`` (default) the new
+        URIs are unioned with the existing set — order-stable, de-duplicated —
+        so re-running with the same URIs is a no-op. ``replace=True`` sets
+        exactly ``redirect_uris``.
+        """
+        oidc = dict(self.get_app(project_id, app_id).get("oidcConfig") or {})
+        existing = list(oidc.get("redirectUris") or [])
+        merged = (
+            list(dict.fromkeys(redirect_uris))
+            if replace
+            else list(dict.fromkeys([*existing, *redirect_uris]))
+        )
+        merged_logout = list(
+            dict.fromkeys([*(oidc.get("postLogoutRedirectUris") or []), *(post_logout_uris or [])])
+        )
+        body = {
+            "redirectUris": merged,
+            "responseTypes": oidc.get("responseTypes") or ["OIDC_RESPONSE_TYPE_CODE"],
+            "grantTypes": oidc.get("grantTypes")
+            or ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"],
+            "appType": oidc.get("appType") or "OIDC_APP_TYPE_WEB",
+            "authMethodType": oidc.get("authMethodType") or "OIDC_AUTH_METHOD_TYPE_BASIC",
+            "postLogoutRedirectUris": merged_logout,
+            "version": oidc.get("version") or "OIDC_VERSION_1_0",
+            "devMode": oidc.get("devMode", False),
+            "accessTokenType": oidc.get("accessTokenType") or "OIDC_TOKEN_TYPE_JWT",
+        }
+        self.request(
+            "PUT",
+            f"/management/v1/projects/{project_id}/apps/{app_id}/oidc_config",
+            body=body,
+        )
+        return {"appId": app_id, "redirectUris": merged}
+
     # ── Login policy / MFA ───────────────────────────────────────────────
 
     def get_login_policy(self) -> dict[str, Any]:

{granny_devops-0.15.0 → granny_devops-0.17.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "granny-devops"
-version = "0.15.0"
+version = "0.17.0"
 description = "Cloud tools collection -- AWS infrastructure, CDN, and DevOps automation"
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -12,6 +12,7 @@ dependencies = [
     "python-dotenv>=1.1.0",
     "requests>=2.32",
     "pyjwt[crypto]>=2.8",  # Zitadel service-account JWT-profile auth (`granny zitadel`)
+    "acme>=2.11",  # Let's Encrypt ACME DNS-01 issuance (granny create letsencrypt-cert)
 ]
 
 [project.optional-dependencies]