From 5d68ff90a8dd6de3cece6e9e84146f3e20d98e03 Mon Sep 17 00:00:00 2001 From: sascha Date: Fri, 14 Aug 2026 10:34:29 +0200 Subject: [PATCH 1/2] =?UTF-8?q?Hetzner-DNS-Vaultalias=20sicher=20aufl?= =?UTF-8?q?=C3=B6sen:=20app.py?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- app.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/app.py b/app.py index c5ffbf8..ee5ffdf 100644 --- a/app.py +++ b/app.py @@ -984,6 +984,9 @@ def _get_hetzner_dns_token() -> str: token = _read("HETZNER_DNS_TOKEN") if token: return token + aliases = [value for key, value in _vault_cache.items() if "hetzner" in key.lower() and "dns" in key.lower() and value.strip()] + if len(aliases) == 1: + return aliases[0].strip() rc, _out, err = _ssh( "sascha@10.4.1.116", "sudo bash /data/stacks/homelab-butler/vault-sync.sh", -- 2.49.1 From 90021b5a4822df3c61d6cb400aebb4d4167e4ff9 Mon Sep 17 00:00:00 2001 From: sascha Date: Fri, 14 Aug 2026 10:34:29 +0200 Subject: [PATCH 2/2] =?UTF-8?q?Hetzner-DNS-Vaultalias=20sicher=20aufl?= =?UTF-8?q?=C3=B6sen:=20tests/test=5Fapp.py?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- tests/test_app.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tests/test_app.py b/tests/test_app.py index a3ea996..cf541dd 100644 --- a/tests/test_app.py +++ b/tests/test_app.py @@ -277,6 +277,13 @@ def test_dns_rrset_dry_run_returns_only_selected_records(monkeypatch): assert body["deleted"] == [] +def test_hetzner_dns_token_accepts_single_sanitized_vault_alias(monkeypatch): + monkeypatch.setattr(app, "_vault_cache", {"hetzner-dns-api": "secret-value", "other": "ignored"}) + monkeypatch.setattr(app, "_read", lambda _name: None) + monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not sync vault"))) + assert app._get_hetzner_dns_token() == "secret-value" + + def test_invalid_log_target_is_rejected_before_ssh(): with TestClient(app.app) as client: response = client.get( -- 2.49.1