mq-ansible icon indicating copy to clipboard operation
mq-ansible copied to clipboard

Remove `passlib` as a dependency

Open CharlieParker opened this issue 1 year ago • 0 comments

passlib was an annoying thing for me to install.

It should just be pip install but when I ran this, I realised Ansible, VS Code, and the command python were all pointing to different versions/envs of python.

To avoid headaches like this, I think it's better to include dependency installation (if not installed) as part of the automation.

I've had a look at where passlib is used and I don't think it's necessary.

Consider the code:

- name: Add the user 'app' with a specific UID
  become: true
  vars:
    apppassword: Passw0rd
  user:
    name: app
    password: "{{ 'apppassword' | password_hash('sha512', 65534 | random(seed=inventory_hostname) | string) }}"
    uid: "{{ app_uid }}"
    group: mqclient

A few thoughts:

  • 'apppassword' != apppassword, one is a var name, the other a literal string. apppassword is never used, 'apppassword' is. This means this default password has been named three times. 'Passw0rd' != 'apppassword' != apppassword
  • There is no point hashing a default password hardcoded into the repository, I think it's obvious it's not a secure/good password.
  • A simpler solution is surely more amenable to varied users who likely have different security strategies.

CharlieParker avatar Jul 28 '23 16:07 CharlieParker