From b9b48200515bdfd79c2d736913c135729a3b341d Mon Sep 17 00:00:00 2001 From: reachableceo Date: Thu, 30 Jul 2026 16:04:59 -0500 Subject: [PATCH] fix(security): remove hardcoded AWX credential from script MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The AWX admin password was hardcoded in scripts/awx_create_job_templates.py. Read credentials from environment variables instead (AWX_USER, AWX_PASSWORD, AWX_URL) and fail loudly when AWX_PASSWORD is unset. No credentials are stored in this repository. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush --- scripts/awx_create_job_templates.py | 30 +++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/scripts/awx_create_job_templates.py b/scripts/awx_create_job_templates.py index d7f2b2f..83301ee 100644 --- a/scripts/awx_create_job_templates.py +++ b/scripts/awx_create_job_templates.py @@ -10,18 +10,32 @@ It will: 4. Create the inventory source (auto-syncs hosts from inventory/hosts.yml) Usage: + export AWX_PASSWORD='...' python3 awx_create_job_templates.py + +Configuration (environment variables): + AWX_URL AWX API base URL (default: http://100.91.39.53/api/v2) + AWX_USER AWX admin username (default: admin) + AWX_PASSWORD AWX admin password (REQUIRED - never committed to the repo) + AWX_PROJECT_ID, AWX_INVENTORY_ID, AWX_SCM_CRED_ID, + AWX_MACHINE_CRED_ID, AWX_ORG_ID resource IDs (sensible defaults below) """ +import os import urllib.request, urllib.parse, json, base64, time, sys -API = "http://100.91.39.53/api/v2" -AUTH = base64.b64encode(b"***REMOVED***").decode() -PROJECT_ID = 10 -INVENTORY_ID = 2 -SCM_CRED_ID = 3 -MACHINE_CRED_ID = 4 -ORG_ID = 1 +API = os.environ.get("AWX_URL", "http://100.91.39.53/api/v2") +_AWX_USER = os.environ.get("AWX_USER", "admin") +_AWX_PASS = os.environ.get("AWX_PASSWORD") +if not _AWX_PASS: + sys.exit("ERROR: AWX_PASSWORD environment variable is not set. " + "Refusing to run — no credentials are stored in this repo.") +AUTH = base64.b64encode(f"{_AWX_USER}:{_AWX_PASS}".encode()).decode() +PROJECT_ID = int(os.environ.get("AWX_PROJECT_ID", "10")) +INVENTORY_ID = int(os.environ.get("AWX_INVENTORY_ID", "2")) +SCM_CRED_ID = int(os.environ.get("AWX_SCM_CRED_ID", "3")) +MACHINE_CRED_ID = int(os.environ.get("AWX_MACHINE_CRED_ID", "4")) +ORG_ID = int(os.environ.get("AWX_ORG_ID", "1")) def awx_req(method, endpoint, data=None): url = f"{API}/{endpoint}" @@ -144,7 +158,7 @@ print("ALL DONE - AWX is ready!") print("=" * 60) print(""" AWX URL: http://tsys-awx.knel.net (or http://100.91.39.53) -Login: admin +Login: $AWX_USER (password supplied via $AWX_PASSWORD env var) Resources created: Credentials: