A simple Django database backend that allows rotating access credentials via HashiCorp Vault
Project description
A simple Django database backend that allows rotating PostgreSQL access credentials via HashiCorp Vault
Usage
In your Django settings:
DATABASES = {
'default': {
'ENGINE': 'django_postgres_vault',
'NAME': os.getenv('DB_NAME'),
'HOST': os.getenv('DB_HOST'),
'PORT': os.getenv('DB_PORT'),
'VAULT_ADDR': os.getenv('VAULT_ADDR'),
'VAULT_TOKEN': os.getenv('VAULT_TOKEN'),
'VAULT_ROLE_NAME': os.getenv('VAULT_ROLE_NAME'),
'VAULT_DB_MOUNT_POINT': os.getenv('VAULT_DB_MOUNT_POINT'),
}
}
Explanation of settings:
NAME: The name of the Postgres database to connect to, as per Django standards.
HOST: The host location of the Postgres database to connect to, as per Django standards.
PORT: The host location port of the Postgres database to connect to, as per Django standards.
VAULT_ADDR: The URL of the Vault server that will be providing rotating access credentials for the database. This is the same value as the VAULT_ADDR variable used by the Vault CLI command. Example: https://vault-host-name:8200
VAULT_DB_MOUNT_POINT: The mount point of the database secrets engine in Vault. Default: database
VAULT_ROLE_NAME: The name of a Vault database secrets engine role configured to provide Postgres credentials.
VAULT_TOKEN: A Vault authentication token with read access to the database secrets engine role.
There are no USER or PASSWORD settings required because those will be dynamically provided by the Vault server. The settings can be provided, but will be ignored.
Installation
pip install django_postgres_vault
Requirements
`` Django>=3.0 psycopg2 hvac ``
Django and hvac should be automatically installed by pip, but psycopg2 will require manual installation. psycopg2 or psycopg2-binary are both acceptable, but explicitly requiring either one in setup.py will make the library less usable for some users, so we defer on that front.
Compatibility
We officially support the most recent version of Django (3.0), as well as its supported Python versions (3.6, 3.7, 3.8). Other versions will most likely work, but there are no guarantees.
Licence
MIT Licensed (see LICENSE)
Testing
Testing is done using Tox and PyTest. A super-simple Dockerfile is provided to allow running Tox in an isolated container.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for django_postgres_vault-0.1.0.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | 5b9d493604fcf784040ef6f25b8bc52519cc5086bd6532d81ecef15d249fd987 |
|
MD5 | 7def665379db990cb6d3020b3cd1af8b |
|
BLAKE2b-256 | 35e7d34015eb3b6878c96cfeec46d0faf33bacd16e975aa843503396ed07326f |
Hashes for django_postgres_vault-0.1.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 0118a6cac1e82a706b533ca423440180c554df6fa73ad4334055317a13e00cd4 |
|
MD5 | 7610ea284af786a262d18147ab4be228 |
|
BLAKE2b-256 | da2ba37dbb508da48216d4595ffcc9b69056510f350302100476a54b539176a3 |