Your Name
a1276f38ad
新增文件: - deploy/install.sh: 7步一键安装(自动检测宝塔/标准模式) - deploy/upgrade.sh: git pull + pip install + restart + 健康检查 - deploy/uninstall.sh: 停服务+删配置, 可选--purge删部署目录 - docs/install-guide.md: 完整中文安装教程(宝塔+手动) 核心改动: - install.py: 宝塔Supervisor路径自适应, init-db返回bt_panel标记, config.php→config.json, 移除PHP锁文件, 生成Fernet加密密钥 - install.html: Step 5根据btPanel显示不同Supervisor/Nginx/SSL指引 - crypto.py: 移除PHP AES-CBC兼容层, 纯Fernet加密 - 删除 web/install.php (1192行PHP, 功能已完全迁移到Python) PHP清理: - Nginx配置: config\.php→config\.json deny规则 - config.py/main.py/migrations.py: install.php注释→install wizard - CLAUDE.md/AGENTS.md: config.php→config.json, 移除PHP引用 - firefox_server.py: login.php→login.html默认URL Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
54 lines
1.6 KiB
Python
54 lines
1.6 KiB
Python
"""Nexus — Encryption Utilities (Fernet)
|
|
Shared crypto module — used by SSH pool, DB credentials, password presets.
|
|
"""
|
|
|
|
import logging
|
|
from cryptography.fernet import Fernet
|
|
|
|
from server.config import settings
|
|
|
|
logger = logging.getLogger("nexus.crypto")
|
|
|
|
|
|
def _fernet() -> Fernet:
|
|
"""Create Fernet instance from ENCRYPTION_KEY.
|
|
|
|
ENCRYPTION_KEY is mandatory — main.py validates it at startup.
|
|
No silent fallback: if ENCRYPTION_KEY is empty, that's a configuration
|
|
error that must be surfaced, not masked.
|
|
"""
|
|
key = settings.ENCRYPTION_KEY
|
|
if not key:
|
|
raise RuntimeError(
|
|
"ENCRYPTION_KEY is empty — cannot initialize Fernet encryption. "
|
|
"Set NEXUS_ENCRYPTION_KEY in .env (generated by install wizard)."
|
|
)
|
|
return Fernet(key.encode() if isinstance(key, str) else key)
|
|
|
|
|
|
_fernet_instance: Fernet | None = None
|
|
|
|
|
|
def get_fernet() -> Fernet:
|
|
global _fernet_instance
|
|
if _fernet_instance is None:
|
|
_fernet_instance = _fernet()
|
|
return _fernet_instance
|
|
|
|
|
|
def encrypt_value(plaintext: str) -> str:
|
|
"""Encrypt a string using Fernet"""
|
|
if not plaintext:
|
|
return plaintext
|
|
return get_fernet().encrypt(plaintext.encode()).decode()
|
|
|
|
|
|
def decrypt_value(ciphertext: str) -> str:
|
|
"""Decrypt a Fernet-encrypted string"""
|
|
if not ciphertext:
|
|
return ciphertext
|
|
try:
|
|
return get_fernet().decrypt(ciphertext.encode()).decode()
|
|
except Exception as e:
|
|
logger.warning(f"Fernet decryption failed (key mismatch?): {e}")
|
|
raise ValueError("Failed to decrypt credential") from e |