feat: add comprehensive environment configuration validation system
- Create validate_config.py script with 100+ validation checks - Validate basic settings (URLs, emails, integers, booleans) - Check security settings and production readiness - Validate feature flags, performance settings, and file upload limits - Support both .env files and direct environment variables - Provide detailed error messages and configuration suggestions - Include environment consistency checks and best practice warnings
This commit is contained in:
William Valentin
456
scripts/validate_config.py
Executable file
456
scripts/validate_config.py
Executable file
@@ -0,0 +1,456 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Environment Configuration Validation Script for UnitForge
|
||||
|
||||
This script validates the environment configuration and checks for common
|
||||
configuration issues. It can be used during development, deployment, and
|
||||
troubleshooting to ensure all settings are properly configured.
|
||||
|
||||
Usage:
|
||||
python scripts/validate_config.py
|
||||
python scripts/validate_config.py --env-file .env.production
|
||||
python scripts/validate_config.py --check-all
|
||||
"""
|
||||
|
||||
import os
|
||||
import sys
|
||||
import json
|
||||
import argparse
|
||||
from pathlib import Path
|
||||
from typing import List, Dict, Any, Tuple, Optional
|
||||
import re
|
||||
|
||||
|
||||
class ConfigValidator:
|
||||
"""Validates UnitForge environment configuration."""
|
||||
|
||||
def __init__(self, env_file: Optional[str] = None):
|
||||
"""Initialize validator with optional environment file."""
|
||||
self.env_file = env_file
|
||||
self.errors: List[str] = []
|
||||
self.warnings: List[str] = []
|
||||
self.info: List[str] = []
|
||||
self.config: Dict[str, Any] = {}
|
||||
|
||||
# Store original environment variables before loading file
|
||||
self.original_env = dict(os.environ)
|
||||
|
||||
# Load environment file if specified
|
||||
if env_file and Path(env_file).exists():
|
||||
self._load_env_file(env_file)
|
||||
|
||||
def _load_env_file(self, env_file: str) -> None:
|
||||
"""Load environment variables from file."""
|
||||
try:
|
||||
with open(env_file, 'r', encoding='utf-8') as f:
|
||||
for line_num, line in enumerate(f, 1):
|
||||
line = line.strip()
|
||||
if line and not line.startswith('#') and '=' in line:
|
||||
key, value = line.split('=', 1)
|
||||
key = key.strip()
|
||||
value = value.strip().strip('"\'')
|
||||
|
||||
# Remove inline comments
|
||||
if '#' in value:
|
||||
value = value.split('#')[0].strip()
|
||||
|
||||
# Don't override existing environment variables
|
||||
if key not in self.original_env:
|
||||
os.environ[key] = value
|
||||
self.config[key] = value
|
||||
self.info.append(f"Loaded environment file: {env_file}")
|
||||
except Exception as e:
|
||||
self.errors.append(f"Failed to load environment file {env_file}: {e}")
|
||||
|
||||
def _get_env_value(self, key: str, default: str = "") -> str:
|
||||
"""Get environment variable value."""
|
||||
return os.getenv(key, default)
|
||||
|
||||
def _validate_boolean(self, key: str, value: str) -> bool:
|
||||
"""Validate boolean environment variable."""
|
||||
if not value:
|
||||
return True # Empty is valid (uses default)
|
||||
|
||||
valid_true = ('true', '1', 'yes', 'on')
|
||||
valid_false = ('false', '0', 'no', 'off')
|
||||
|
||||
if value.lower() not in valid_true + valid_false:
|
||||
self.errors.append(f"{key}: Invalid boolean value '{value}'. Use: {valid_true + valid_false}")
|
||||
return False
|
||||
return True
|
||||
|
||||
def _validate_integer(self, key: str, value: str, min_val: int = 0, max_val: int = None) -> bool:
|
||||
"""Validate integer environment variable."""
|
||||
if not value:
|
||||
return True # Empty is valid (uses default)
|
||||
|
||||
try:
|
||||
int_val = int(value)
|
||||
if int_val < min_val:
|
||||
self.errors.append(f"{key}: Value {int_val} is below minimum {min_val}")
|
||||
return False
|
||||
if max_val is not None and int_val > max_val:
|
||||
self.errors.append(f"{key}: Value {int_val} is above maximum {max_val}")
|
||||
return False
|
||||
return True
|
||||
except ValueError:
|
||||
self.errors.append(f"{key}: Invalid integer value '{value}'")
|
||||
return False
|
||||
|
||||
def _validate_url(self, key: str, value: str) -> bool:
|
||||
"""Validate URL format."""
|
||||
if not value:
|
||||
return True # Empty is valid for optional URLs
|
||||
|
||||
url_pattern = re.compile(
|
||||
r'^https?://' # http:// or https://
|
||||
r'(?:(?:[A-Z0-9](?:[A-Z0-9-]{0,61}[A-Z0-9])?\.)+[A-Z]{2,6}\.?|' # domain
|
||||
r'localhost|' # localhost
|
||||
r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})' # IP
|
||||
r'(?::\d+)?' # optional port
|
||||
r'(?:/?|[/?]\S+)$', re.IGNORECASE)
|
||||
|
||||
if not url_pattern.match(value):
|
||||
self.errors.append(f"{key}: Invalid URL format '{value}'")
|
||||
return False
|
||||
return True
|
||||
|
||||
def _validate_email(self, key: str, value: str) -> bool:
|
||||
"""Validate email format."""
|
||||
if not value:
|
||||
return True # Empty is valid for optional emails
|
||||
|
||||
email_pattern = re.compile(r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$')
|
||||
if not email_pattern.match(value):
|
||||
self.errors.append(f"{key}: Invalid email format '{value}'")
|
||||
return False
|
||||
return True
|
||||
|
||||
def _validate_json_array(self, key: str, value: str) -> bool:
|
||||
"""Validate JSON array format."""
|
||||
if not value or value == "*":
|
||||
return True # Empty or wildcard is valid
|
||||
|
||||
try:
|
||||
parsed = json.loads(value)
|
||||
if not isinstance(parsed, list):
|
||||
self.errors.append(f"{key}: Must be a JSON array, got {type(parsed).__name__}")
|
||||
return False
|
||||
return True
|
||||
except json.JSONDecodeError as e:
|
||||
# Try comma-separated format
|
||||
if ',' in value and not value.startswith('['):
|
||||
self.warnings.append(f"{key}: Using comma-separated format. Consider JSON array format for clarity")
|
||||
return True
|
||||
self.errors.append(f"{key}: Invalid JSON array format: {e}")
|
||||
return False
|
||||
|
||||
def _validate_log_level(self, key: str, value: str) -> bool:
|
||||
"""Validate log level."""
|
||||
if not value:
|
||||
return True
|
||||
|
||||
valid_levels = ('debug', 'info', 'warning', 'error', 'critical')
|
||||
if value.lower() not in valid_levels:
|
||||
self.errors.append(f"{key}: Invalid log level '{value}'. Valid levels: {valid_levels}")
|
||||
return False
|
||||
return True
|
||||
|
||||
def _validate_environment(self, key: str, value: str) -> bool:
|
||||
"""Validate environment name."""
|
||||
if not value:
|
||||
return True
|
||||
|
||||
valid_envs = ('development', 'staging', 'production', 'test')
|
||||
if value.lower() not in valid_envs:
|
||||
self.warnings.append(f"{key}: Unusual environment '{value}'. Common values: {valid_envs}")
|
||||
return True
|
||||
|
||||
def _validate_file_extensions(self, key: str, value: str) -> bool:
|
||||
"""Validate file extensions format."""
|
||||
if not value:
|
||||
return True
|
||||
|
||||
try:
|
||||
if value.startswith('['):
|
||||
# JSON array format
|
||||
extensions = json.loads(value)
|
||||
if not isinstance(extensions, list):
|
||||
self.errors.append(f"{key}: Must be a list of extensions")
|
||||
return False
|
||||
else:
|
||||
# Comma-separated format
|
||||
extensions = [ext.strip() for ext in value.split(',')]
|
||||
|
||||
for ext in extensions:
|
||||
if not ext.startswith('.'):
|
||||
self.errors.append(f"{key}: Extension '{ext}' should start with '.'")
|
||||
return False
|
||||
return True
|
||||
except Exception as e:
|
||||
self.errors.append(f"{key}: Invalid extensions format: {e}")
|
||||
return False
|
||||
|
||||
def validate_basic_config(self) -> None:
|
||||
"""Validate basic application configuration."""
|
||||
print("🔍 Validating basic configuration...")
|
||||
|
||||
# Application Information
|
||||
app_name = self._get_env_value('APP_NAME')
|
||||
if not app_name:
|
||||
self.warnings.append("APP_NAME: Not set, using default")
|
||||
elif len(app_name) > 100:
|
||||
self.warnings.append("APP_NAME: Very long name (>100 chars)")
|
||||
|
||||
app_version = self._get_env_value('APP_VERSION')
|
||||
if app_version and not re.match(r'^\d+\.\d+\.\d+', app_version):
|
||||
self.warnings.append(f"APP_VERSION: Unusual version format '{app_version}'")
|
||||
|
||||
# URLs
|
||||
self._validate_url('GITHUB_URL', self._get_env_value('GITHUB_URL'))
|
||||
self._validate_url('DOCUMENTATION_URL', self._get_env_value('DOCUMENTATION_URL'))
|
||||
self._validate_url('BUG_REPORTS_URL', self._get_env_value('BUG_REPORTS_URL'))
|
||||
|
||||
# Email
|
||||
self._validate_email('CONTACT_EMAIL', self._get_env_value('CONTACT_EMAIL'))
|
||||
|
||||
def validate_server_config(self) -> None:
|
||||
"""Validate server configuration."""
|
||||
print("🔍 Validating server configuration...")
|
||||
|
||||
# Boolean values
|
||||
self._validate_boolean('DEBUG', self._get_env_value('DEBUG'))
|
||||
self._validate_boolean('RELOAD', self._get_env_value('RELOAD'))
|
||||
|
||||
# Environment
|
||||
self._validate_environment('ENVIRONMENT', self._get_env_value('ENVIRONMENT'))
|
||||
self._validate_log_level('LOG_LEVEL', self._get_env_value('LOG_LEVEL'))
|
||||
|
||||
# Integer values
|
||||
self._validate_integer('PORT', self._get_env_value('PORT'), 1, 65535)
|
||||
self._validate_integer('WORKERS', self._get_env_value('WORKERS'), 1, 64)
|
||||
|
||||
# Host validation
|
||||
host = self._get_env_value('HOST')
|
||||
if host and host not in ('0.0.0.0', '127.0.0.1', 'localhost'):
|
||||
# Basic IP validation
|
||||
if not re.match(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$', host):
|
||||
self.warnings.append(f"HOST: Unusual host value '{host}'")
|
||||
|
||||
def validate_security_config(self) -> None:
|
||||
"""Validate security configuration."""
|
||||
print("🔍 Validating security configuration...")
|
||||
|
||||
# Secret key
|
||||
secret_key = self._get_env_value('SECRET_KEY')
|
||||
env = self._get_env_value('ENVIRONMENT', 'production').lower()
|
||||
|
||||
if secret_key:
|
||||
if len(secret_key) < 32:
|
||||
self.warnings.append("SECRET_KEY: Too short, use at least 32 characters")
|
||||
if secret_key in ('your-secret-key-here', 'dev-secret-key-change-in-production'):
|
||||
if env == 'production':
|
||||
self.errors.append("SECRET_KEY: Using default/example secret key in production!")
|
||||
else:
|
||||
self.warnings.append("SECRET_KEY: Using example secret key (OK for development)")
|
||||
elif env == 'production':
|
||||
self.warnings.append("SECRET_KEY: Not set in production environment")
|
||||
|
||||
# Boolean security settings
|
||||
self._validate_boolean('SECURITY_HEADERS', self._get_env_value('SECURITY_HEADERS'))
|
||||
self._validate_boolean('CSP_ENABLED', self._get_env_value('CSP_ENABLED'))
|
||||
|
||||
# HSTS settings
|
||||
self._validate_integer('HSTS_MAX_AGE', self._get_env_value('HSTS_MAX_AGE'), 0)
|
||||
|
||||
# CORS
|
||||
cors_origins = self._get_env_value('CORS_ORIGINS')
|
||||
if cors_origins != '*':
|
||||
self._validate_json_array('CORS_ORIGINS', cors_origins)
|
||||
|
||||
# Allowed hosts
|
||||
self._validate_json_array('ALLOWED_HOSTS', self._get_env_value('ALLOWED_HOSTS'))
|
||||
|
||||
def validate_feature_flags(self) -> None:
|
||||
"""Validate feature flags."""
|
||||
print("🔍 Validating feature flags...")
|
||||
|
||||
feature_flags = [
|
||||
'ENABLE_API_METRICS', 'ENABLE_REQUEST_LOGGING',
|
||||
'ENABLE_TEMPLATE_CACHING', 'ENABLE_VALIDATION_CACHING',
|
||||
'HEALTH_CHECK_ENABLED', 'METRICS_ENABLED', 'TRACING_ENABLED',
|
||||
'API_DOCS_ENABLED', 'SWAGGER_UI_ENABLED', 'REDOC_ENABLED',
|
||||
'HOT_RELOAD', 'SOURCE_MAPS', 'MINIFY_ASSETS', 'COMPRESS_RESPONSES'
|
||||
]
|
||||
|
||||
for flag in feature_flags:
|
||||
self._validate_boolean(flag, self._get_env_value(flag))
|
||||
|
||||
def validate_performance_config(self) -> None:
|
||||
"""Validate performance configuration."""
|
||||
print("🔍 Validating performance configuration...")
|
||||
|
||||
# Timeout settings
|
||||
self._validate_integer('REQUEST_TIMEOUT', self._get_env_value('REQUEST_TIMEOUT'), 1, 3600)
|
||||
self._validate_integer('KEEPALIVE_TIMEOUT', self._get_env_value('KEEPALIVE_TIMEOUT'), 1, 300)
|
||||
self._validate_integer('MAX_CONNECTIONS', self._get_env_value('MAX_CONNECTIONS'), 1, 10000)
|
||||
|
||||
# Cache settings
|
||||
self._validate_integer('TEMPLATE_CACHE_TTL', self._get_env_value('TEMPLATE_CACHE_TTL'), 0)
|
||||
self._validate_integer('VALIDATION_CACHE_TTL', self._get_env_value('VALIDATION_CACHE_TTL'), 0)
|
||||
|
||||
# File upload
|
||||
self._validate_integer('MAX_UPLOAD_SIZE', self._get_env_value('MAX_UPLOAD_SIZE'), 1024)
|
||||
self._validate_file_extensions('ALLOWED_EXTENSIONS', self._get_env_value('ALLOWED_EXTENSIONS'))
|
||||
|
||||
def validate_production_readiness(self) -> None:
|
||||
"""Validate production readiness."""
|
||||
print("🔍 Validating production readiness...")
|
||||
|
||||
env = self._get_env_value('ENVIRONMENT', 'production').lower()
|
||||
debug = self._get_env_value('DEBUG', 'false').lower() in ('true', '1', 'yes', 'on')
|
||||
|
||||
if env == 'production':
|
||||
if debug:
|
||||
self.errors.append("Production environment should not have DEBUG=true")
|
||||
|
||||
if not self._get_env_value('SECRET_KEY'):
|
||||
self.errors.append("Production environment must have SECRET_KEY set")
|
||||
|
||||
cors_origins = self._get_env_value('CORS_ORIGINS', '*')
|
||||
if cors_origins == '*':
|
||||
self.warnings.append("Production environment using wildcard CORS origins")
|
||||
|
||||
if self._get_env_value('SECURITY_HEADERS', 'true').lower() not in ('true', '1', 'yes', 'on'):
|
||||
self.warnings.append("Production environment should enable SECURITY_HEADERS")
|
||||
|
||||
workers = int(self._get_env_value('WORKERS', '4'))
|
||||
if workers < 2:
|
||||
self.warnings.append("Production environment should use multiple workers")
|
||||
|
||||
def check_environment_consistency(self) -> None:
|
||||
"""Check for environment consistency issues."""
|
||||
print("🔍 Checking environment consistency...")
|
||||
|
||||
# Debug mode consistency
|
||||
debug = self._get_env_value('DEBUG', 'false').lower() in ('true', '1', 'yes', 'on')
|
||||
env = self._get_env_value('ENVIRONMENT', 'production').lower()
|
||||
log_level = self._get_env_value('LOG_LEVEL', 'info').lower()
|
||||
|
||||
if debug and env == 'production':
|
||||
self.warnings.append("DEBUG mode enabled in production environment")
|
||||
|
||||
if debug and log_level not in ('debug', 'info'):
|
||||
self.warnings.append("DEBUG mode with non-debug log level")
|
||||
|
||||
# Performance consistency
|
||||
hot_reload = self._get_env_value('HOT_RELOAD', 'false').lower() in ('true', '1', 'yes', 'on')
|
||||
minify = self._get_env_value('MINIFY_ASSETS', 'true').lower() in ('true', '1', 'yes', 'on')
|
||||
|
||||
if hot_reload and minify:
|
||||
self.warnings.append("HOT_RELOAD and MINIFY_ASSETS both enabled (unusual for development)")
|
||||
|
||||
def validate_all(self) -> Tuple[int, int, int]:
|
||||
"""Run all validations and return counts."""
|
||||
print("🚀 Starting UnitForge configuration validation...\n")
|
||||
|
||||
self.validate_basic_config()
|
||||
self.validate_server_config()
|
||||
self.validate_security_config()
|
||||
self.validate_feature_flags()
|
||||
self.validate_performance_config()
|
||||
self.validate_production_readiness()
|
||||
self.check_environment_consistency()
|
||||
|
||||
return len(self.errors), len(self.warnings), len(self.info)
|
||||
|
||||
def print_results(self) -> None:
|
||||
"""Print validation results."""
|
||||
print("\n" + "="*60)
|
||||
print("🔍 CONFIGURATION VALIDATION RESULTS")
|
||||
print("="*60)
|
||||
|
||||
if self.info:
|
||||
print(f"\n📋 Information ({len(self.info)}):")
|
||||
for msg in self.info:
|
||||
print(f" ℹ️ {msg}")
|
||||
|
||||
if self.warnings:
|
||||
print(f"\n⚠️ Warnings ({len(self.warnings)}):")
|
||||
for msg in self.warnings:
|
||||
print(f" ⚠️ {msg}")
|
||||
|
||||
if self.errors:
|
||||
print(f"\n❌ Errors ({len(self.errors)}):")
|
||||
for msg in self.errors:
|
||||
print(f" ❌ {msg}")
|
||||
|
||||
print(f"\n📊 Summary:")
|
||||
print(f" • Errors: {len(self.errors)}")
|
||||
print(f" • Warnings: {len(self.warnings)}")
|
||||
print(f" • Info: {len(self.info)}")
|
||||
|
||||
if len(self.errors) == 0 and len(self.warnings) == 0:
|
||||
print("\n✅ Configuration validation passed!")
|
||||
elif len(self.errors) == 0:
|
||||
print("\n⚠️ Configuration validation passed with warnings.")
|
||||
else:
|
||||
print("\n❌ Configuration validation failed.")
|
||||
|
||||
print("="*60)
|
||||
|
||||
|
||||
def main():
|
||||
"""Main function."""
|
||||
parser = argparse.ArgumentParser(
|
||||
description="Validate UnitForge environment configuration",
|
||||
formatter_class=argparse.RawDescriptionHelpFormatter
|
||||
)
|
||||
parser.add_argument(
|
||||
'--env-file',
|
||||
type=str,
|
||||
help="Path to environment file to load (default: .env)"
|
||||
)
|
||||
parser.add_argument(
|
||||
'--check-all',
|
||||
action='store_true',
|
||||
help="Run all validation checks including production readiness"
|
||||
)
|
||||
parser.add_argument(
|
||||
'--quiet',
|
||||
action='store_true',
|
||||
help="Suppress informational output"
|
||||
)
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
# Default to .env if it exists
|
||||
env_file = args.env_file
|
||||
if not env_file and Path('.env').exists():
|
||||
env_file = '.env'
|
||||
|
||||
validator = ConfigValidator(env_file)
|
||||
|
||||
if not args.quiet:
|
||||
if env_file:
|
||||
print(f"📄 Using environment file: {env_file}")
|
||||
else:
|
||||
print("📄 Using system environment variables only")
|
||||
print()
|
||||
|
||||
# Run validation
|
||||
errors, warnings, info = validator.validate_all()
|
||||
|
||||
# Print results
|
||||
if not args.quiet:
|
||||
validator.print_results()
|
||||
|
||||
# Exit with appropriate code
|
||||
if errors > 0:
|
||||
sys.exit(1)
|
||||
else:
|
||||
sys.exit(0)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user