generate_secrets.py

#!/usr/bin/env python3
"""Generate strong random passwords for the files under secrets/.

Passwords are drawn from a CSPRNG via the `secrets` module. The alphabet
excludes quotes, backslashes, `$` and whitespace since these values get
interpolated into SQL statements and shell commands by the container
entrypoints.
"""

import argparse
import secrets
import string
from pathlib import Path

REPO_ROOT = Path(__file__).resolve().parent.parent
SECRETS_DIR = REPO_ROOT / "secrets"

DEFAULT_LENGTH = 32
ALPHABET = string.ascii_letters + string.digits + "!@#%^&*()-_=+[]{}:;,.?/~"

SECRET_FILES = [
    "db_root_password.txt",
    "db_user_password.txt",
    "ftp_user_password.txt",
    "wp_admin_password.txt",
    "wp_user_password.txt",
]


def generate_password(length: int) -> str:
    return "".join(secrets.choice(ALPHABET) for _ in range(length))


def main() -> None:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument(
        "-f", "--force", action="store_true",
        help="overwrite files that already exist",
    )
    parser.add_argument(
        "-l", "--length", type=int, default=DEFAULT_LENGTH,
        help="password length (default: %(default)s)",
    )
    args = parser.parse_args()

    SECRETS_DIR.mkdir(exist_ok=True)

    for filename in SECRET_FILES:
        path = SECRETS_DIR / filename
        if path.exists() and not args.force:
            print(f"skip   {path} (already exists, use --force to overwrite)")
            continue
        path.write_text(generate_password(args.length) + "\n")
        path.chmod(0o600)
        print(f"wrote  {path}")


if __name__ == "__main__":
    main()