Skip to content

Commit d758421

Browse files
fed1337fed1337
committed
Upstream merged, urllib3 updated to address security alert, added telegram notification plugin
1 parent ea3548b commit d758421

File tree

11 files changed

+456
-415
lines changed

11 files changed

+456
-415
lines changed

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
/.tmp/
66
*.egg-info
77
*.pyc
8-
*.log
8+
*.log*
99
*.egg
1010
*.db
1111
*.pid

‎compose.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ services:
66
POSTGRES_USER: lemur
77
POSTGRES_PASSWORD: lemur
88
POSTGRES_HOST: postgres
9+
network_mode: host
910
ports:
1011
- "5432:5432"
1112
volumes:

‎lemur.conf.py‎

Lines changed: 132 additions & 136 deletions
Original file line numberDiff line numberDiff line change
@@ -3,26 +3,24 @@
33
Reads environment variables and defaults to a value suitable for dev/test environment if not set
44
"""
55

6-
import base64
7-
import os.path
8-
import secrets
9-
import string
10-
from typing import Dict, Any, List
11-
12-
_basedir = os.path.abspath(os.path.dirname(__file__))
6+
from os.path import abspath, dirname, realpath
7+
from os import environ
8+
# from typing import Dict, Any
139

10+
_basedir = abspath(dirname(__file__))
1411

1512
# General
16-
THREADS_PER_PAGE = os.environ.get("THREADS_PER_PAGE", 8)
17-
CORS = os.environ.get("CORS", True)
18-
DEBUG = os.environ.get("DEBUG", True)
13+
THREADS_PER_PAGE = environ.get("THREADS_PER_PAGE", 8)
14+
CORS = environ.get("CORS", True)
15+
DEBUG = environ.get("DEBUG", True)
16+
LEMUR_HOSTNAME = environ.get("LEMUR_HOSTNAME", "localhost")
1917

2018
# Logging
21-
LOG_LEVEL = os.environ.get("LOG_LEVEL", "DEBUG")
22-
LOG_FILE = os.environ.get("LOG_FILE", "lemur.log")
23-
LOG_UPGRADE_FILE = os.environ.get("LOG_UPGRADE_FILE", "db_upgrade.log")
24-
LOG_REQUEST_HEADERS = os.environ.get("LOG_REQUEST_HEADERS", "False")
25-
LOG_SANITIZE_REQUEST_HEADERS = os.environ.get("LOG_SANITIZE_REQUEST_HEADERS", "True")
19+
LOG_LEVEL = environ.get("LOG_LEVEL", "DEBUG")
20+
LOG_FILE = environ.get("LOG_FILE", "lemur.log")
21+
LOG_UPGRADE_FILE = environ.get("LOG_UPGRADE_FILE", "db_upgrade.log")
22+
LOG_REQUEST_HEADERS = environ.get("LOG_REQUEST_HEADERS", "False")
23+
LOG_SANITIZE_REQUEST_HEADERS = environ.get("LOG_SANITIZE_REQUEST_HEADERS", "True")
2624
LOG_REQUEST_HEADERS_SKIP_ENDPOINT = ["/metrics", "/healthcheck"] # These endpoints are noisy so skip them by default
2725

2826
# This is the secret key used by flask session management
@@ -41,8 +39,16 @@
4139
LEMUR_DEFAULT_ORGANIZATION = ""
4240
LEMUR_DEFAULT_ORGANIZATIONAL_UNIT = ""
4341
LEMUR_SECURITY_TEAM_EMAIL = ["admin@localhost"]
44-
SQLALCHEMY_DATABASE_URI = os.environ.get('SQLALCHEMY_DATABASE_URI', 'postgresql://lemur:lemur@localhost:5432/lemur')
4542

43+
# Database settings
44+
SQLALCHEMY_DATABASE_URI = environ.get('SQLALCHEMY_DATABASE_URI', 'postgresql://lemur:lemur@localhost:5432/lemur')
45+
# SQLALCHEMY_ENABLE_FLASK_REPLICATED = False
46+
# SQLALCHEMY_TRACK_MODIFICATIONS = False
47+
# SQLALCHEMY_ECHO = True
48+
# SQLALCHEMY_ENGINE_OPTIONS = {
49+
# 'pool_recycle': 499,
50+
# 'pool_timeout': 20,
51+
# }
4652

4753
# LEMUR_DEFAULT_ISSUER_PLUGIN=cryptography-issuer
4854
# LEMUR_DEFAULT_AUTHORITY=cryptography
@@ -85,127 +91,118 @@
8591
IDP_PROTECT_BUILTINS = True
8692
IDP_CREATE_PER_USER_ROLE = True # Generates Lemur role for each user (allows cert assignment to a single user)
8793

88-
8994
# # this is the secret used to generate oauth state tokens
90-
# OAUTH_STATE_TOKEN_SECRET = repr(os.environ.get('OAUTH_STATE_TOKEN_SECRET', base64.b64encode(get_random_secret(32).encode('utf8'))))
91-
#
95+
# OAUTH_STATE_TOKEN_SECRET = repr(environ.get('OAUTH_STATE_TOKEN_SECRET', '')
96+
9297
# REDIS_HOST = 'redis'
9398
# REDIS_PORT = 6379
9499
# REDIS_DB = 0
95100
# CELERY_RESULT_BACKEND = f'redis://{REDIS_HOST}:{REDIS_PORT}'
96101
# CELERY_BROKER_URL = f'redis://{REDIS_HOST}:{REDIS_PORT}'
97102
# CELERY_IMPORTS = ('lemur.common.celery')
98103
# CELERYBEAT_SCHEDULE: Dict[str, Any] = {
99-
# All tasks are disabled by default. Enable any tasks you wish to run.
100-
# 'fetch_all_pending_acme_certs': {
101-
# 'task': 'lemur.common.celery.fetch_all_pending_acme_certs',
102-
# 'options': {
103-
# 'expires': 180
104-
# },
105-
# 'schedule': crontab(minute="*"),
106-
# },
107-
# 'remove_old_acme_certs': {
108-
# 'task': 'lemur.common.celery.remove_old_acme_certs',
109-
# 'options': {
110-
# 'expires': 180
111-
# },
112-
# 'schedule': crontab(hour=8, minute=0, day_of_week=5),
113-
# },
114-
# 'clean_all_sources': {
115-
# 'task': 'lemur.common.celery.clean_all_sources',
116-
# 'options': {
117-
# 'expires': 180
118-
# },
119-
# 'schedule': crontab(hour=5, minute=0, day_of_week=5),
120-
# },
121-
# 'sync_all_sources': {
122-
# 'task': 'lemur.common.celery.sync_all_sources',
123-
# 'options': {
124-
# 'expires': 180
125-
# },
126-
# 'schedule': crontab(hour="*/2", minute=0),
127-
# },
128-
# 'report_celery_last_success_metrics': {
129-
# 'task': 'lemur.common.celery.report_celery_last_success_metrics',
130-
# 'options': {
131-
# 'expires': 180
132-
# },
133-
# 'schedule': crontab(minute="*"),
134-
# },
135-
# 'certificate_reissue': {
136-
# 'task': 'lemur.common.celery.certificate_reissue',
137-
# 'options': {
138-
# 'expires': 180
139-
# },
140-
# 'schedule': crontab(hour=9, minute=0),
141-
# },
142-
# 'certificate_rotate': {
143-
# 'task': 'lemur.common.celery.certificate_rotate',
144-
# 'options': {
145-
# 'expires': 180
146-
# },
147-
# 'schedule': crontab(hour=10, minute=0),
148-
# },
149-
# 'get_all_zones': {
150-
# 'task': 'lemur.common.celery.get_all_zones',
151-
# 'options': {
152-
# 'expires': 180
153-
# },
154-
# 'schedule': crontab(minute="*/30"),
155-
# },
156-
# 'check_revoked': {
157-
# 'task': 'lemur.common.celery.check_revoked',
158-
# 'options': {
159-
# 'expires': 180
160-
# },
161-
# 'schedule': crontab(hour=10, minute=0),
162-
# }
163-
# 'enable_autorotate_for_certs_attached_to_destination': {
164-
# 'task': 'lemur.common.celery.enable_autorotate_for_certs_attached_to_destination',
165-
# 'options': {
166-
# 'expires': 180
167-
# },
168-
# 'schedule': crontab(hour=10, minute=0),
169-
# }
170-
# 'enable_autorotate_for_certs_attached_to_endpoint': {
171-
# 'task': 'lemur.common.celery.enable_autorotate_for_certs_attached_to_endpoint',
172-
# 'options': {
173-
# 'expires': 180
174-
# },
175-
# 'schedule': crontab(hour=10, minute=0),
176-
# }
177-
# 'notify_expirations': {
178-
# 'task': 'lemur.common.celery.notify_expirations',
179-
# 'options': {
180-
# 'expires': 180
181-
# },
182-
# 'schedule': crontab(hour=10, minute=0),
183-
# },
184-
# 'notify_authority_expirations': {
185-
# 'task': 'lemur.common.celery.notify_authority_expirations',
186-
# 'options': {
187-
# 'expires': 180
188-
# },
189-
# 'schedule': crontab(hour=10, minute=0),
190-
# },
191-
# 'send_security_expiration_summary': {
192-
# 'task': 'lemur.common.celery.send_security_expiration_summary',
193-
# 'options': {
194-
# 'expires': 180
195-
# },
196-
# 'schedule': crontab(hour=10, minute=0, day_of_week='mon-fri'),
197-
# }
104+
# All tasks are disabled by default. Enable any tasks you wish to run.
105+
# 'fetch_all_pending_acme_certs': {
106+
# 'task': 'lemur.common.celery.fetch_all_pending_acme_certs',
107+
# 'options': {
108+
# 'expires': 180
109+
# },
110+
# 'schedule': crontab(minute="*"),
111+
# },
112+
# 'remove_old_acme_certs': {
113+
# 'task': 'lemur.common.celery.remove_old_acme_certs',
114+
# 'options': {
115+
# 'expires': 180
116+
# },
117+
# 'schedule': crontab(hour=8, minute=0, day_of_week=5),
118+
# },
119+
# 'clean_all_sources': {
120+
# 'task': 'lemur.common.celery.clean_all_sources',
121+
# 'options': {
122+
# 'expires': 180
123+
# },
124+
# 'schedule': crontab(hour=5, minute=0, day_of_week=5),
125+
# },
126+
# 'sync_all_sources': {
127+
# 'task': 'lemur.common.celery.sync_all_sources',
128+
# 'options': {
129+
# 'expires': 180
130+
# },
131+
# 'schedule': crontab(hour="*/2", minute=0),
132+
# },
133+
# 'report_celery_last_success_metrics': {
134+
# 'task': 'lemur.common.celery.report_celery_last_success_metrics',
135+
# 'options': {
136+
# 'expires': 180
137+
# },
138+
# 'schedule': crontab(minute="*"),
139+
# },
140+
# 'certificate_reissue': {
141+
# 'task': 'lemur.common.celery.certificate_reissue',
142+
# 'options': {
143+
# 'expires': 180
144+
# },
145+
# 'schedule': crontab(hour=9, minute=0),
146+
# },
147+
# 'certificate_rotate': {
148+
# 'task': 'lemur.common.celery.certificate_rotate',
149+
# 'options': {
150+
# 'expires': 180
151+
# },
152+
# 'schedule': crontab(hour=10, minute=0),
153+
# },
154+
# 'get_all_zones': {
155+
# 'task': 'lemur.common.celery.get_all_zones',
156+
# 'options': {
157+
# 'expires': 180
158+
# },
159+
# 'schedule': crontab(minute="*/30"),
160+
# },
161+
# 'check_revoked': {
162+
# 'task': 'lemur.common.celery.check_revoked',
163+
# 'options': {
164+
# 'expires': 180
165+
# },
166+
# 'schedule': crontab(hour=10, minute=0),
167+
# }
168+
# 'enable_autorotate_for_certs_attached_to_destination': {
169+
# 'task': 'lemur.common.celery.enable_autorotate_for_certs_attached_to_destination',
170+
# 'options': {
171+
# 'expires': 180
172+
# },
173+
# 'schedule': crontab(hour=10, minute=0),
174+
# }
175+
# 'enable_autorotate_for_certs_attached_to_endpoint': {
176+
# 'task': 'lemur.common.celery.enable_autorotate_for_certs_attached_to_endpoint',
177+
# 'options': {
178+
# 'expires': 180
179+
# },
180+
# 'schedule': crontab(hour=10, minute=0),
181+
# }
182+
# 'notify_expirations': {
183+
# 'task': 'lemur.common.celery.notify_expirations',
184+
# 'options': {
185+
# 'expires': 180
186+
# },
187+
# 'schedule': crontab(hour=10, minute=0),
188+
# },
189+
# 'notify_authority_expirations': {
190+
# 'task': 'lemur.common.celery.notify_authority_expirations',
191+
# 'options': {
192+
# 'expires': 180
193+
# },
194+
# 'schedule': crontab(hour=10, minute=0),
195+
# },
196+
# 'send_security_expiration_summary': {
197+
# 'task': 'lemur.common.celery.send_security_expiration_summary',
198+
# 'options': {
199+
# 'expires': 180
200+
# },
201+
# 'schedule': crontab(hour=10, minute=0, day_of_week='mon-fri'),
202+
# }
198203
# }
199204
# CELERY_TIMEZONE = 'UTC'
200205
#
201-
# SQLALCHEMY_ENABLE_FLASK_REPLICATED = False
202-
# SQLALCHEMY_TRACK_MODIFICATIONS = False
203-
# SQLALCHEMY_ECHO = True
204-
# SQLALCHEMY_ENGINE_OPTIONS = {
205-
# 'pool_recycle': 499,
206-
# 'pool_timeout': 20,
207-
# }
208-
#
209206
# LEMUR_EMAIL = '[email protected]'
210207
# LEMUR_SECURITY_TEAM_EMAIL_INTERVALS = [15, 2]
211208
# LEMUR_DEFAULT_EXPIRATION_NOTIFICATION_INTERVALS = [30, 15, 2]
@@ -218,16 +215,15 @@
218215
# DEFAULT_VALIDITY_DAYS = 365
219216
#
220217
# LEMUR_OWNER_EMAIL_IN_SUBJECT = False
221-
# LEMUR_DEFAULT_AUTHORITY = str(os.environ.get('LEMUR_DEFAULT_AUTHORITY', 'ExampleCa'))
218+
# LEMUR_DEFAULT_AUTHORITY = str(environ.get('LEMUR_DEFAULT_AUTHORITY', 'ExampleCa'))
222219
# LEMUR_DEFAULT_ROLE = 'operator'
223-
#
224-
# # Authority Settings - These will change depending on which authorities you are
225-
# # using
226-
# current_path = os.path.dirname(os.path.realpath(__file__))
227-
#
228-
# # DNS Settings
229-
#
230-
# # exclude logging missing SAN, since we can have certs from private CAs with only cn, prod parity
220+
221+
# Authority Settings - These will change depending on which authorities you are using
222+
# current_path = dirname(realpath(__file__))
223+
224+
# DNS Settings
225+
226+
# exclude logging missing SAN, since we can have certs from private CAs with only cn, prod parity
231227
# LOG_SSL_SUBJ_ALT_NAME_ERRORS = False
232228
#
233229
# ACME_DNS_PROVIDER_TYPES = {"items": [
@@ -266,6 +262,6 @@
266262
# 'name': 'ultradns',
267263
# },
268264
# ]}
269-
#
265+
270266
# # Authority plugins which support revocation
271267
# SUPPORTED_REVOCATION_AUTHORITY_PLUGINS = ['acme-issuer']

‎lemur/__about__.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@
1313
__summary__ = "Certificate management and orchestration service"
1414
__uri__ = "https://github.com/Netflix/lemur"
1515

16-
__version__ = "1.3.dev0"
16+
__version__ = "1.8.3+f"
1717

1818
__author__ = "The Lemur developers"
1919
__email__ = "[email protected]"
2020

2121
__license__ = "Apache License, Version 2.0"
22-
__copyright__ = f"Copyright 2018 {__author__}"
22+
__copyright__ = f"Copyright 2025 {__author__}"

‎lemur/plugins/lemur_aws/iam.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -288,15 +288,15 @@ def _filter_ignored_certificates(certificates, **kwargs):
288288
filtered_certificates = []
289289

290290
for cert in certificates:
291-
# Get the ARN for the certificate
292-
cert_arn = cert.get("ServerCertificateMetadata", {}).get("Arn")
293-
if not cert_arn:
291+
# Get the certificate name for the certificate
292+
cert_name = cert.get("ServerCertificateMetadata", {}).get("ServerCertificateName")
293+
if not cert_name:
294294
filtered_certificates.append(cert)
295295
continue
296296

297297
try:
298298
# Get tags for the certificate
299-
tags_response = client.list_tags_for_resource(ResourceName=cert_arn)
299+
tags_response = client.list_server_certificate_tags(ServerCertificateName=cert_name)
300300
tags = tags_response.get("Tags", [])
301301

302302
# If the certificate has any ignore tags, skip it

‎lemur/plugins/lemur_telegram/__init__.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
try:
2+
from importlib.metadata import version
3+
VERSION = version(__name__)
4+
except Exception as e:
5+
VERSION = "unknown"

0 commit comments

Comments
 (0)