granny-devops 0.16.0__tar.gz → 0.17.1__tar.gz

{granny_devops-0.16.0 → granny_devops-0.17.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: granny-devops
-Version: 0.16.0
+Version: 0.17.1
 Summary: Cloud tools collection -- AWS infrastructure, CDN, and DevOps automation
 Author-email: Martin Wieser <martin.wieser@pseekoo.com>
 License: MIT License
@@ -26,6 +26,7 @@ License: MIT License
         SOFTWARE.
 License-File: LICENSE
 Requires-Python: >=3.13
+Requires-Dist: acme>=2.11
 Requires-Dist: boto3>=1.38
 Requires-Dist: click>=8.1
 Requires-Dist: pyjwt[crypto]>=2.8
@@ -292,6 +293,10 @@ granny email workmail create-user example.com --email user@example.com
 granny create s3-website example.com --help
 granny create scaleway-container --name my-app --port 3000
 granny create mailjet-dns example.com
+granny create letsencrypt-cert \
+  --domain '*.example.com' --domain example.com \
+  --dns inwx --zone example.com \
+  --email ops@example.com --out-dir ./certs   # real LE cert via ACME dns-01, any granny DNS provider
 
 # Authentik admin (provider + application + group plumbing)
 granny authentik provision-oauth-app my-app \
@@ -315,6 +320,9 @@ granny authentik api GET /api/v3/core/users/me/        # generic escape hatch
 granny zitadel create-project platform
 granny zitadel create-oidc-app platform my-app \
   --redirect-uri https://app.example.com/oidc/callback
+granny zitadel set-redirect-uris --project platform --app my-app \
+  --redirect-uri https://app.example.com/oidc/callback \
+  --redirect-uri https://app.example.com/oidc/callback2   # merges by default; --replace to set exactly
 granny zitadel rotate-secret platform my-app
 granny zitadel create-user alice --email alice@example.com --password 's3cret'
 granny zitadel ensure-role platform admin                 # Zitadel uses project roles, not groups
@@ -370,7 +378,7 @@ granny indexing google https://example.com/job-posting --action URL_UPDATED
 | Email send infra | Mailjet, AWS SES, AWS WorkMail |
 | AWS inventory | VPCs, Lambdas |
 | Cross-cloud inventory | GPU instances + reservations, credit balances, MTD spend + forecast (AWS, GCP, Azure) |
-| SSL automation | Bunny, Cloudflare, ACM |
+| SSL automation | Bunny, Cloudflare, ACM, Let's Encrypt (ACME dns-01 over any granny DNS provider) |
 | SSO / IdP | Authentik (provider, application, group, and user operations) |
 | Observability admin | Elasticsearch / Kibana native-user management |
 | Azure ops | Identity, subscriptions, ARM deployments, Cognitive Services (Azure OpenAI), App Service, VM sizes, VM inventory/deallocate/delete, RBAC role assignment, compute quota |

{granny_devops-0.16.0 → granny_devops-0.17.1}/README.md

@@ -159,6 +159,10 @@ granny email workmail create-user example.com --email user@example.com
 granny create s3-website example.com --help
 granny create scaleway-container --name my-app --port 3000
 granny create mailjet-dns example.com
+granny create letsencrypt-cert \
+  --domain '*.example.com' --domain example.com \
+  --dns inwx --zone example.com \
+  --email ops@example.com --out-dir ./certs   # real LE cert via ACME dns-01, any granny DNS provider
 
 # Authentik admin (provider + application + group plumbing)
 granny authentik provision-oauth-app my-app \
@@ -182,6 +186,9 @@ granny authentik api GET /api/v3/core/users/me/        # generic escape hatch
 granny zitadel create-project platform
 granny zitadel create-oidc-app platform my-app \
   --redirect-uri https://app.example.com/oidc/callback
+granny zitadel set-redirect-uris --project platform --app my-app \
+  --redirect-uri https://app.example.com/oidc/callback \
+  --redirect-uri https://app.example.com/oidc/callback2   # merges by default; --replace to set exactly
 granny zitadel rotate-secret platform my-app
 granny zitadel create-user alice --email alice@example.com --password 's3cret'
 granny zitadel ensure-role platform admin                 # Zitadel uses project roles, not groups
@@ -237,7 +244,7 @@ granny indexing google https://example.com/job-posting --action URL_UPDATED
 | Email send infra | Mailjet, AWS SES, AWS WorkMail |
 | AWS inventory | VPCs, Lambdas |
 | Cross-cloud inventory | GPU instances + reservations, credit balances, MTD spend + forecast (AWS, GCP, Azure) |
-| SSL automation | Bunny, Cloudflare, ACM |
+| SSL automation | Bunny, Cloudflare, ACM, Let's Encrypt (ACME dns-01 over any granny DNS provider) |
 | SSO / IdP | Authentik (provider, application, group, and user operations) |
 | Observability admin | Elasticsearch / Kibana native-user management |
 | Azure ops | Identity, subscriptions, ARM deployments, Cognitive Services (Azure OpenAI), App Service, VM sizes, VM inventory/deallocate/delete, RBAC role assignment, compute quota |

{granny_devops-0.16.0 → granny_devops-0.17.1}/granny/__init__.py

@@ -1,6 +1,6 @@
 """Granny -- Cloud tools collection for AWS infrastructure and DevOps automation."""
 
-__version__ = "0.16.0"
+__version__ = "0.17.1"
 __all__ = [
     "get_secret",
     "load_secrets_into_env",

{granny_devops-0.16.0 → granny_devops-0.17.1}/granny/cli/create.py

@@ -33,6 +33,7 @@ COMMANDS: dict[str, str] = {
     "scaleway-container": "setup_scaleway_container.py",
     "workmail": "setup_workmail.py",
     "auto-certificate": "auto_certificate.py",
+    "letsencrypt-cert": "letsencrypt_cert.py",
     "mailjet-contacts": "manage_mailjet_contacts.py",
 }
 

{granny_devops-0.16.0 → granny_devops-0.17.1}/granny/cli/zitadel.py

@@ -8,7 +8,10 @@ env/vault pipeline. See :class:`granny.zitadel.ZitadelClient`.
 from __future__ import annotations
 
 import json
+import secrets
+import string
 import sys
+from pathlib import Path
 
 import click
 
@@ -23,6 +26,35 @@ def _client() -> ZitadelClient:
         sys.exit(1)
 
 
+def _client_for(domain: str, key_file: str | None, pat: str | None) -> ZitadelClient:
+    """Build a client for an EXPLICIT instance (SA key file or PAT).
+
+    Unlike :func:`_client` (``from_environment``), this never falls back to the
+    ambient/locke credential — required when addressing a specific instance
+    (e.g. the dev Zitadel) rather than whatever the environment defaults to.
+    """
+    if key_file:
+        try:
+            key = json.loads(Path(key_file).read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError) as exc:
+            raise click.ClickException(f"cannot read SA key {key_file}: {exc}") from exc
+        return ZitadelClient.from_service_account(key, domain)
+    if pat:
+        return ZitadelClient(base_url=domain, token=pat)
+    raise click.ClickException(
+        f"provide a service-account key file or PAT for {domain}"
+    )
+
+
+def _generate_temp_password() -> str:
+    """Strong, policy-safe temp password: 4 upper + 4 lower + 3 digit + 2 symbol, shuffled."""
+    pools = (string.ascii_uppercase, string.ascii_lowercase, string.digits, "!@#$%*-_?")
+    counts = (4, 4, 3, 2)
+    chars = [secrets.choice(p) for p, n in zip(pools, counts) for _ in range(n)]
+    secrets.SystemRandom().shuffle(chars)
+    return "".join(chars)
+
+
 @click.group()
 def zitadel() -> None:
     """Manage Zitadel (projects, OIDC apps, MFA policy) via its REST API."""
@@ -355,11 +387,15 @@ def create_pat_cmd(user: str, expiration: str | None, dry_run: bool) -> None:
     at vault `granny/infra/zitadel-api-token` (or export ZITADEL_API_TOKEN).
     """
     if dry_run:
-        click.echo(f"[DRY RUN] Would create a PAT for {user!r} (expiration={expiration})")
+        click.echo(
+            f"[DRY RUN] Would create a PAT for {user!r} (expiration={expiration})"
+        )
         return
     client = _client()
     out = client.create_pat(_resolve_user(client, user), expiration_date=expiration)
-    click.echo(json.dumps({"tokenId": out.get("tokenId"), "token": out.get("token")}, indent=2))
+    click.echo(
+        json.dumps({"tokenId": out.get("tokenId"), "token": out.get("token")}, indent=2)
+    )
 
 
 @zitadel.command("revoke-pat")
@@ -373,20 +409,22 @@ def revoke_pat_cmd(user: str, token_id: str, dry_run: bool) -> None:
         return
     client = _client()
     client.delete_pat(_resolve_user(client, user), token_id)
-    click.echo(json.dumps({"user": user, "tokenId": token_id, "revoked": True}, indent=2))
+    click.echo(
+        json.dumps({"user": user, "tokenId": token_id, "revoked": True}, indent=2)
+    )
 
 
 # ── list ─────────────────────────────────────────────────────────────────
 
 
 @zitadel.command("list")
-@click.argument("kind", type=click.Choice(["users", "projects", "apps", "roles", "pats"]))
-@click.option(
-    "--project", default=None, help="Project (id or name) — required for apps/roles."
+@click.argument(
+    "kind", type=click.Choice(["users", "projects", "apps", "roles", "pats"])
 )
 @click.option(
-    "--user", default=None, help="User (userName or id) — required for pats."
+    "--project", default=None, help="Project (id or name) — required for apps/roles."
 )
+@click.option("--user", default=None, help="User (userName or id) — required for pats.")
 @click.option(
     "--json", "as_json", is_flag=True, help="Emit full JSON instead of a table."
 )
@@ -527,3 +565,135 @@ def revoke_user_role_cmd(project: str, user: str, dry_run: bool) -> None:
     click.echo(
         json.dumps({"project": project, "user": user, "revoked": True}, indent=2)
     )
+
+
+# ── mirror users across instances ──────────────────────────────────────────
+
+
+@zitadel.command("mirror-users")
+@click.option(
+    "--source-domain",
+    required=True,
+    help="Source Zitadel base URL (e.g. https://id.pseekoo.io).",
+)
+@click.option(
+    "--source-key-file", default=None, help="Source service-account key JSON file."
+)
+@click.option(
+    "--source-pat", default=None, help="Source PAT (alternative to --source-key-file)."
+)
+@click.option(
+    "--target-domain",
+    required=True,
+    help="Target Zitadel base URL (e.g. https://id-dev.obachan.dev).",
+)
+@click.option(
+    "--target-key-file", default=None, help="Target service-account key JSON file."
+)
+@click.option(
+    "--target-pat", default=None, help="Target PAT (alternative to --target-key-file)."
+)
+@click.option(
+    "--password-out",
+    required=True,
+    type=click.Path(dir_okay=False),
+    help="File to WRITE generated temp passwords (TSV). Secrets go here only, never stdout.",
+)
+@click.option("--skip", "skip", multiple=True, help="Username to skip (repeatable).")
+@click.option(
+    "--no-email-verified",
+    is_flag=True,
+    help="Do not pre-verify copied emails (default: mark verified).",
+)
+@click.option(
+    "--dry-run", is_flag=True, help="List what would be created; write nothing."
+)
+def mirror_users_cmd(
+    source_domain: str,
+    source_key_file: str | None,
+    source_pat: str | None,
+    target_domain: str,
+    target_key_file: str | None,
+    target_pat: str | None,
+    password_out: str,
+    skip: tuple[str, ...],
+    no_email_verified: bool,
+    dry_run: bool,
+) -> None:
+    """Copy HUMAN users from a source Zitadel to a target with generated temp passwords.
+
+    Each created user gets a random strong temp password with
+    ``passwordChangeRequired`` (forced reset on first login). Passwords are
+    WRITTEN ONLY to ``--password-out`` (TSV), never printed. Idempotent: users
+    already present on the target are skipped; machine/service accounts are never
+    copied. Source and target are addressed EXPLICITLY (key file or PAT) so this
+    works across two instances (e.g. prod -> dev) without relying on the ambient
+    credential.
+    """
+    src = _client_for(source_domain, source_key_file, source_pat)
+    tgt = _client_for(target_domain, target_key_file, target_pat)
+    skipset = set(skip)
+
+    src_humans: dict[str, dict[str, str | None]] = {}
+    for u in src.list_users():
+        human = u.get("human")
+        if not human:
+            continue  # never copy machine/service accounts
+        username = u.get("userName") or u.get("username")
+        if not username or username in skipset:
+            continue
+        profile = human.get("profile", {})
+        src_humans[username] = {
+            "email": human.get("email", {}).get("email"),
+            "first": profile.get("firstName", ""),
+            "last": profile.get("lastName", ""),
+            "display": profile.get("displayName"),
+        }
+
+    existing = {u.get("userName") or u.get("username") for u in tgt.list_users()}
+    todo = {un: info for un, info in src_humans.items() if un not in existing}
+
+    if dry_run:
+        for un, info in todo.items():
+            click.echo(f"[DRY RUN] would create {un} ({info['email']})")
+        click.echo(
+            f"[DRY RUN] {len(todo)} to create, "
+            f"{len(src_humans) - len(todo)} already present on target"
+        )
+        return
+
+    out_path = Path(password_out)
+    created: list[str] = []
+    failed: list[dict[str, str]] = []
+    with out_path.open("w", encoding="utf-8") as fh:
+        fh.write("username\temail\ttemp_password\tuserId\n")
+        for un, info in todo.items():
+            pw = _generate_temp_password()
+            try:
+                res = tgt.create_user(
+                    un,
+                    email=info["email"],
+                    first_name=info["first"] or "",
+                    last_name=info["last"] or "",
+                    display_name=info["display"],
+                    password=pw,
+                    email_verified=not no_email_verified,
+                    password_change_required=True,
+                )
+                uid = res.get("userId") or res.get("id") or ""
+                fh.write(f"{un}\t{info['email']}\t{pw}\t{uid}\n")
+                created.append(un)
+            except ZitadelError as exc:
+                failed.append({"user": un, "error": str(exc)[:160]})
+
+    click.echo(
+        json.dumps(
+            {
+                "created": created,
+                "skipped_existing": len(src_humans) - len(todo),
+                "failed": failed,
+                "passwords_written_to": str(out_path),
+            },
+            indent=2,
+        )
+    )

granny_devops-0.17.1/granny/create/letsencrypt_cert.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+"""Let's Encrypt certificate issuance via ACME DNS-01, driven by granny's DNS
+providers.
+
+Unlike ``auto_certificate.py`` (AWS ACM / Bunny), this issues a real
+Let's Encrypt certificate (fullchain + private key PEM) usable by Caddy,
+nginx, Kubernetes Secrets, etc. The ACME ``dns-01`` challenge is solved by
+creating ``_acme-challenge`` TXT records through **any** granny DNS provider
+(``--dns inwx`` / ``cloudflare`` / ``hetzner`` / ...), so it works for zones
+like ``obachan.dev`` (INWX) where no cert-manager webhook exists.
+
+Example::
+
+    granny create letsencrypt-cert \\
+        --domain '*.obachan.dev' --domain obachan.dev \\
+        --dns inwx --zone obachan.dev \\
+        --email ops@example.com --out-dir ./certs
+
+Credentials for the DNS provider resolve through granny's normal vault/env
+pipeline (e.g. INWX_USERNAME / INWX_PASSWORD / INWX_SHARED_SECRET).
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+import time
+from pathlib import Path
+
+import requests
+
+try:  # granny's vault→env pipeline (same as auto_certificate.py)
+    from granny.credentials import load_secrets_into_env
+
+    load_secrets_into_env()
+except Exception:  # pragma: no cover - best effort
+    pass
+
+_LE_PROD = "https://acme-v02.api.letsencrypt.org/directory"
+_LE_STAGING = "https://acme-staging-v02.api.letsencrypt.org/directory"
+_DOH = "https://dns.google/resolve"
+
+
+def _new_rsa_key():  # noqa: ANN202
+    from cryptography.hazmat.primitives.asymmetric import rsa
+
+    return rsa.generate_private_key(public_exponent=65537, key_size=2048)
+
+
+def _key_pem(key) -> bytes:  # noqa: ANN001
+    from cryptography.hazmat.primitives import serialization
+
+    return key.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.TraditionalOpenSSL,
+        serialization.NoEncryption(),
+    )
+
+
+def _relative_name(fqdn: str, zone: str) -> str:
+    """Strip the trailing ``.<zone>`` so provider APIs get the short name."""
+    fqdn = fqdn.rstrip(".")
+    suffix = "." + zone.rstrip(".")
+    return fqdn[: -len(suffix)] if fqdn.endswith(suffix) else fqdn
+
+
+def _txt_propagated(fqdn: str, value: str, *, attempts: int, delay: int) -> bool:
+    """Poll public DNS (DoH) until the challenge TXT value is visible."""
+    for i in range(attempts):
+        try:
+            resp = requests.get(
+                _DOH, params={"name": fqdn, "type": "TXT"}, timeout=10
+            ).json()
+            answers = [a.get("data", "").strip('"') for a in resp.get("Answer", [])]
+            if value in answers:
+                return True
+        except Exception:  # noqa: BLE001 - transient resolver errors are fine
+            pass
+        if i < attempts - 1:
+            time.sleep(delay)
+    return False
+
+
+def issue_certificate(
+    domains: list[str],
+    *,
+    dns: str,
+    zone: str,
+    email: str,
+    staging: bool = False,
+    propagation_attempts: int = 20,
+    propagation_delay: int = 15,
+) -> tuple[str, str]:
+    """Issue a Let's Encrypt cert for ``domains``; return (fullchain_pem, key_pem).
+
+    ``dns`` is a granny DNS provider name; ``zone`` is the registrable zone the
+    challenge records live in (e.g. ``obachan.dev``).
+    """
+    import josepy as jose
+    from acme import challenges, client, crypto_util, messages
+
+    from granny.dns.factory import get_provider
+
+    provider = get_provider(dns)
+    zone_id = provider.get_zone_id(zone)
+
+    directory_url = _LE_STAGING if staging else _LE_PROD
+    account_key = jose.JWKRSA(key=_new_rsa_key())
+    net = client.ClientNetwork(account_key, user_agent="granny-letsencrypt")
+    directory = client.ClientV2.get_directory(directory_url, net)
+    acme = client.ClientV2(directory, net)
+    acme.new_account(
+        messages.NewRegistration.from_data(email=email, terms_of_service_agreed=True)
+    )
+
+    cert_key = _new_rsa_key()
+    cert_key_pem = _key_pem(cert_key)
+    csr_pem = crypto_util.make_csr(cert_key_pem, domains)
+    order = acme.new_order(csr_pem)
+
+    created: list[tuple[str, str, str]] = []  # (fqdn, value, record_id) for cleanup
+    try:
+        # 1. Publish every dns-01 TXT record first (a base domain + its wildcard
+        #    share `_acme-challenge.<domain>`, so multiple values can coexist).
+        pending = []
+        for authz in order.authorizations:
+            dom = authz.body.identifier.value
+            chall = next(
+                c for c in authz.body.challenges if isinstance(c.chall, challenges.DNS01)
+            )
+            response, validation = chall.response_and_validation(account_key)
+            fqdn = chall.chall.validation_domain_name(dom)
+            rec = provider.create_record(
+                zone_id, _relative_name(fqdn, zone), "TXT", validation
+            )
+            created.append((fqdn, validation, rec.id))
+            pending.append((fqdn, validation, chall, response))
+            print(f"  published TXT {fqdn} = {validation[:12]}…", file=sys.stderr)
+
+        # 2. Wait for propagation, then answer each challenge.
+        for fqdn, validation, chall, response in pending:
+            if not _txt_propagated(
+                fqdn, validation, attempts=propagation_attempts, delay=propagation_delay
+            ):
+                raise TimeoutError(f"TXT for {fqdn} did not propagate in time")
+            acme.answer_challenge(chall, response)
+            print(f"  answered challenge for {fqdn}", file=sys.stderr)
+
+        # 3. Finalize + download.
+        order = acme.poll_and_finalize(order)
+    finally:
+        for _fqdn, _val, rec_id in created:
+            try:
+                provider.delete_record(zone_id, rec_id)
+            except Exception:  # noqa: BLE001 - best-effort cleanup
+                pass
+
+    return order.fullchain_pem, cert_key_pem.decode("utf-8")
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Issue a Let's Encrypt cert via DNS-01.")
+    parser.add_argument("--domain", action="append", required=True, help="Domain (repeatable; wildcards ok).")
+    parser.add_argument("--dns", required=True, help="granny DNS provider (e.g. inwx, cloudflare).")
+    parser.add_argument("--zone", required=True, help="Registrable zone the challenge records live in.")
+    parser.add_argument("--email", required=True, help="ACME account contact email.")
+    parser.add_argument("--out-dir", default=".", help="Directory to write fullchain.pem + key.pem.")
+    parser.add_argument("--staging", action="store_true", help="Use the LE staging CA (no rate limits).")
+    parser.add_argument("--propagation-attempts", type=int, default=20)
+    parser.add_argument("--propagation-delay", type=int, default=15)
+    args = parser.parse_args(argv)
+
+    fullchain, key = issue_certificate(
+        args.domain,
+        dns=args.dns,
+        zone=args.zone,
+        email=args.email,
+        staging=args.staging,
+        propagation_attempts=args.propagation_attempts,
+        propagation_delay=args.propagation_delay,
+    )
+
+    out = Path(args.out_dir)
+    out.mkdir(parents=True, exist_ok=True)
+    (out / "fullchain.pem").write_text(fullchain, encoding="utf-8")
+    (out / "key.pem").write_text(key, encoding="utf-8")
+    print(f"wrote {out / 'fullchain.pem'} and {out / 'key.pem'}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{granny_devops-0.16.0 → granny_devops-0.17.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "granny-devops"
-version = "0.16.0"
+version = "0.17.1"
 description = "Cloud tools collection -- AWS infrastructure, CDN, and DevOps automation"
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -12,6 +12,7 @@ dependencies = [
     "python-dotenv>=1.1.0",
     "requests>=2.32",
     "pyjwt[crypto]>=2.8",  # Zitadel service-account JWT-profile auth (`granny zitadel`)
+    "acme>=2.11",  # Let's Encrypt ACME DNS-01 issuance (granny create letsencrypt-cert)
 ]
 
 [project.optional-dependencies]