quay/config.py

import requests
import os.path

from data.buildlogs import BuildLogs
from data.userevent import UserEventBuilder


def build_requests_session():
  sess = requests.Session()
  adapter = requests.adapters.HTTPAdapter(pool_connections=100,
                                          pool_maxsize=100)
  sess.mount('http://', adapter)
  sess.mount('https://', adapter)
  return sess


# The set of configuration key names that will be accessible in the client. Since these
# values are sent to the frontend, DO NOT PLACE ANY SECRETS OR KEYS in this list.
CLIENT_WHITELIST = ['SERVER_HOSTNAME', 'PREFERRED_URL_SCHEME', 'MIXPANEL_KEY',
                    'STRIPE_PUBLISHABLE_KEY', 'ENTERPRISE_LOGO_URL', 'SENTRY_PUBLIC_DSN',
                    'AUTHENTICATION_TYPE', 'REGISTRY_TITLE', 'REGISTRY_TITLE_SHORT',
                    'CONTACT_INFO', 'AVATAR_KIND', 'LOCAL_OAUTH_HANDLER', 'DOCUMENTATION_LOCATION',
                    'DOCUMENTATION_METADATA', 'SETUP_COMPLETE']


def frontend_visible_config(config_dict):
  visible_dict = {}
  for name in CLIENT_WHITELIST:
    if name.lower().find('secret') >= 0:
      raise Exception('Cannot whitelist secrets: %s' % name)

    if name in config_dict:
      visible_dict[name] = config_dict.get(name, None)

  return visible_dict


class DefaultConfig(object):
  # Flask config
  JSONIFY_PRETTYPRINT_REGULAR = False
  SESSION_COOKIE_SECURE = False

  LOGGING_LEVEL = 'DEBUG'
  SEND_FILE_MAX_AGE_DEFAULT = 0
  PREFERRED_URL_SCHEME = 'http'
  SERVER_HOSTNAME = 'localhost:5000'

  REGISTRY_TITLE = 'Quay Enterprise'
  REGISTRY_TITLE_SHORT = 'Quay Enterprise'

  CONTACT_INFO = [
    'mailto:support@quay.io',
    'irc://chat.freenode.net:6665/quay',
    'tel:+1-888-930-3475',
    'https://twitter.com/quayio',
  ]

  # Mail config
  MAIL_SERVER = ''
  MAIL_USE_TLS = True
  MAIL_PORT = 587
  MAIL_USERNAME = None
  MAIL_PASSWORD = None
  MAIL_DEFAULT_SENDER = 'support@quay.io'
  MAIL_FAIL_SILENTLY = False
  TESTING = True

  # DB config
  DB_URI = 'sqlite:///test/data/test.db'
  DB_CONNECTION_ARGS = {
    'threadlocals': True,
    'autorollback': True,
  }

  @staticmethod
  def create_transaction(db):
    return db.transaction()

  DB_TRANSACTION_FACTORY = create_transaction

  # If true, CDN URLs will be used for our external dependencies, rather than the local
  # copies.
  USE_CDN = True

  # Authentication
  AUTHENTICATION_TYPE = 'Database'

  # Build logs
  BUILDLOGS_REDIS = {'host': 'localhost'}
  BUILDLOGS_OPTIONS = []

  # Real-time user events
  USER_EVENTS_REDIS = {'host': 'localhost'}

  # Stripe config
  BILLING_TYPE = 'FakeStripe'

  # Analytics
  ANALYTICS_TYPE = 'FakeAnalytics'

  # Build Queue Metrics
  QUEUE_METRICS_TYPE = 'Null'

  # Exception logging
  EXCEPTION_LOG_TYPE = 'FakeSentry'
  SENTRY_DSN = None
  SENTRY_PUBLIC_DSN = None

  # Github Config
  GITHUB_LOGIN_CONFIG = None
  GITHUB_TRIGGER_CONFIG = None

  # Google Config.
  GOOGLE_LOGIN_CONFIG = None

  # Bitbucket Config.
  BITBUCKET_TRIGGER_CONFIG = None

  # Requests based HTTP client with a large request pool
  HTTPCLIENT = build_requests_session()

  # Status tag config
  STATUS_TAGS = {}
  for tag_name in ['building', 'failed', 'none', 'ready']:
    tag_path = os.path.join('buildstatus', tag_name + '.svg')
    with open(tag_path) as tag_svg:
      STATUS_TAGS[tag_name] = tag_svg.read()

  NOTIFICATION_QUEUE_NAME = 'notification'
  DOCKERFILE_BUILD_QUEUE_NAME = 'dockerfilebuild'
  REPLICATION_QUEUE_NAME = 'imagestoragereplication'
  SECSCAN_NOTIFICATION_QUEUE_NAME = 'secscan_notification'

  # Super user config. Note: This MUST BE an empty list for the default config.
  SUPER_USERS = []

  # Feature Flag: Whether super users are supported.
  FEATURE_SUPER_USERS = True

  # Feature Flag: Whether to allow anonymous users to browse and pull public repositories.
  FEATURE_ANONYMOUS_ACCESS = True

  # Feature Flag: Whether billing is required.
  FEATURE_BILLING = False

  # Feature Flag: Whether user accounts automatically have usage log access.
  FEATURE_USER_LOG_ACCESS = False

  # Feature Flag: Whether GitHub login is supported.
  FEATURE_GITHUB_LOGIN = False

  # Feature Flag: Whether Google login is supported.
  FEATURE_GOOGLE_LOGIN = False

  # Feature Flag: Whther Dex login is supported.
  FEATURE_DEX_LOGIN = False

  # Feature flag, whether to enable olark chat
  FEATURE_OLARK_CHAT = False

  # Feature Flag: Whether to support GitHub build triggers.
  FEATURE_GITHUB_BUILD = False

  # Feature Flag: Whether to support Bitbucket build triggers.
  FEATURE_BITBUCKET_BUILD = False

  # Feature Flag: Whether to support GitLab build triggers.
  FEATURE_GITLAB_BUILD = False

  # Feature Flag: Dockerfile build support.
  FEATURE_BUILD_SUPPORT = True

  # Feature Flag: Whether emails are enabled.
  FEATURE_MAILING = True

  # Feature Flag: Whether users can be created (by non-super users).
  FEATURE_USER_CREATION = True

  # Feature Flag: Whether users can be renamed
  FEATURE_USER_RENAME = False

  # Feature Flag: Whether non-encrypted passwords (as opposed to encrypted tokens) can be used for
  # basic auth.
  FEATURE_REQUIRE_ENCRYPTED_BASIC_AUTH = False

  # Feature Flag: Whether to automatically replicate between storage engines.
  FEATURE_STORAGE_REPLICATION = False

  # Feature Flag: Whether users can directly login to the UI.
  FEATURE_DIRECT_LOGIN = True

  # Feature Flag: Whether the v2/ endpoint is visible
  FEATURE_ADVERTISE_V2 = True

  # Semver spec for which Docker versions we will blacklist
  # Documentation: http://pythonhosted.org/semantic_version/reference.html#semantic_version.Spec
  BLACKLIST_V2_SPEC = '<1.6.0'

  # Feature Flag: Whether or not to rotate old action logs to storage.
  FEATURE_ACTION_LOG_ROTATION = False

  # Feature Flag: Whether to allow for "namespace-less" repositories when pulling and pushing from
  # Docker.
  FEATURE_LIBRARY_SUPPORT = True

  # The namespace to use for library repositories.
  # Note: This must remain 'library' until Docker removes their hard-coded namespace for libraries.
  # See: https://github.com/docker/docker/blob/master/registry/session.go#L320
  LIBRARY_NAMESPACE = 'library'


  BUILD_MANAGER = ('enterprise', {})

  DISTRIBUTED_STORAGE_CONFIG = {
    'local_eu': ['LocalStorage', {'storage_path': 'test/data/registry/eu'}],
    'local_us': ['LocalStorage', {'storage_path': 'test/data/registry/us'}],
  }

  DISTRIBUTED_STORAGE_PREFERENCE = ['local_us']
  DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS = ['local_us']

  # Health checker.
  HEALTH_CHECKER = ('LocalHealthCheck', {})

  # Userfiles
  USERFILES_LOCATION = 'local_us'
  USERFILES_PATH = 'userfiles/'

  # Build logs archive
  LOG_ARCHIVE_LOCATION = 'local_us'
  LOG_ARCHIVE_PATH = 'logarchive/'

  # Action logs archive
  ACTION_LOG_ARCHIVE_LOCATION = 'local_us'
  ACTION_LOG_ARCHIVE_PATH = 'actionlogarchive/'

  # For enterprise:
  MAXIMUM_REPOSITORY_USAGE = 20

  # System logs.
  SYSTEM_LOGS_PATH = "/var/log/"
  SYSTEM_LOGS_FILE = "/var/log/syslog"
  SYSTEM_SERVICES_PATH = "conf/init/service/"

  # Services that should not be shown in the logs view.
  SYSTEM_SERVICE_BLACKLIST = []

  # Temporary tag expiration in seconds, this may actually be longer based on GC policy
  PUSH_TEMP_TAG_EXPIRATION_SEC = 60 * 60  # One hour per layer

  # Signed registry grant token expiration in seconds
  SIGNED_GRANT_EXPIRATION_SEC = 60 * 60 * 24  # One day to complete a push/pull

  # Registry v2 JWT Auth config
  JWT_AUTH_MAX_FRESH_S = 60 * 60 + 60  # At most signed for one hour, accounting for clock skew
  JWT_AUTH_TOKEN_ISSUER = 'quay-test-issuer'
  JWT_AUTH_CERTIFICATE_PATH = 'conf/selfsigned/jwt.crt'
  JWT_AUTH_PRIVATE_KEY_PATH = 'conf/selfsigned/jwt.key.insecure'

  # The URL endpoint to which we redirect OAuth when generating a token locally.
  LOCAL_OAUTH_HANDLER = '/oauth/localapp'

  # The various avatar background colors.
  AVATAR_KIND = 'local'
  AVATAR_COLORS = ['#969696', '#aec7e8', '#ff7f0e', '#ffbb78', '#2ca02c', '#98df8a', '#d62728',
                   '#ff9896', '#9467bd', '#c5b0d5', '#8c564b', '#c49c94', '#e377c2', '#f7b6d2',
                   '#7f7f7f', '#c7c7c7', '#bcbd22', '#1f77b4', '#17becf', '#9edae5', '#393b79',
                   '#5254a3', '#6b6ecf', '#9c9ede', '#9ecae1', '#31a354', '#b5cf6b', '#a1d99b',
                   '#8c6d31', '#ad494a', '#e7ba52', '#a55194']

  # The location of the Quay documentation.
  DOCUMENTATION_LOCATION = 'http://docs.quay.io'
  DOCUMENTATION_METADATA = 'https://coreos.github.io/quay-docs/search.json'

  # How often the Garbage Collection worker runs.
  GARBAGE_COLLECTION_FREQUENCY = 30 # seconds

  # Security scanner
  FEATURE_SECURITY_SCANNER = False
  SECURITY_SCANNER = {
    'ENDPOINT': 'http://192.168.99.101:6060',
    'ENGINE_VERSION_TARGET': 1,
    'API_VERSION': 'v1',
    'API_TIMEOUT_SECONDS': 10,
  }

  # Torrent management flags
  FEATURE_BITTORRENT = False
  BITTORRENT_PIECE_SIZE = 512 * 1024
  BITTORRENT_ANNOUNCE_URL = 'https://localhost:6881/announce'
  BITTORRENT_FILENAME_PEPPER = '3ae93fef-c30a-427e-9ba0-eea0fd710419'