Spaces:
Sleeping
Sleeping
| #!/usr/bin/env python3 | |
| """ | |
| Generate .htpasswd file for Nginx Basic Authentication. | |
| Uses NGINX_USERNAME and NGINX_PASSWORD environment variables. | |
| Supports bcrypt hashing with fallback mechanisms. | |
| """ | |
| import os | |
| import sys | |
| def generate_htpasswd(): | |
| """ | |
| Generate an .htpasswd file for Nginx Basic Authentication. | |
| Creates a password file with the specified username and password, hashed using | |
| the most secure available method. The file is saved to the path specified by | |
| HTPASSWD_PATH environment variable (default: /etc/nginx/.htpasswd). | |
| The function attempts to hash the password in the following order of preference: | |
| 1. bcrypt (most secure, recommended for modern Nginx) | |
| 2. openssl passwd with SHA-512 (-6 option) | |
| 3. crypt module with SHA-512 method | |
| The generated file is created with read permissions for owner and group (0640). | |
| Environment Variables: | |
| NGINX_USERNAME: Username for authentication. Defaults to "admin" if not set. | |
| NGINX_PASSWORD: Password for authentication. Must be set and non-empty. | |
| HTPASSWD_PATH: Path where the .htpasswd file will be created. | |
| Defaults to "/etc/nginx/.htpasswd". | |
| Raises: | |
| SystemExit: If NGINX_PASSWORD is not set or empty (exit code 1). | |
| If password hashing fails (exit code 1). | |
| If file creation fails (exit code 1). | |
| Returns: | |
| None: Prints success/error messages to stdout/stderr. | |
| Example: | |
| Set environment variables and run: | |
| >>> export NGINX_USERNAME=user | |
| >>> export NGINX_PASSWORD=secret | |
| >>> export HTPASSWD_PATH=/tmp/.htpasswd | |
| >>> generate_htpasswd() | |
| [SUCCESS] .htpasswd created successfully at /tmp/.htpasswd for user 'user'. | |
| """ | |
| username = os.getenv("NGINX_USERNAME", "admin").strip() | |
| password = os.getenv("NGINX_PASSWORD", "").strip() | |
| if not password: | |
| print("[ERROR] NGINX_PASSWORD environment variable is not set or empty.", file=sys.stderr) | |
| sys.exit(1) | |
| target_path = os.getenv("HTPASSWD_PATH", "/etc/nginx/.htpasswd") | |
| # Attempt bcrypt hashing first (most secure and standard for modern Nginx) | |
| hashed_entry = None | |
| try: | |
| import bcrypt | |
| hashed_password = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt(rounds=12)).decode('utf-8') | |
| hashed_entry = f"{username}:{hashed_password}\n" | |
| except ImportError: | |
| pass | |
| # Fallback to crypt module or openssl if bcrypt is not available | |
| if not hashed_entry: | |
| try: | |
| import subprocess | |
| res = subprocess.run(["openssl", "passwd", "-6", password], capture_output=True, text=True, check=True) | |
| hashed_entry = f"{username}:{res.stdout.strip()}\n" | |
| except Exception: | |
| try: | |
| import crypt | |
| hashed_password = crypt.crypt(password, crypt.mksalt(crypt.METHOD_SHA512)) | |
| hashed_entry = f"{username}:{hashed_password}\n" | |
| except Exception as e: | |
| print(f"[ERROR] Could not hash password: {e}", file=sys.stderr) | |
| sys.exit(1) | |
| try: | |
| os.makedirs(os.path.dirname(target_path), exist_ok=True) | |
| with open(target_path, "w", encoding="utf-8") as f: | |
| f.write(hashed_entry) | |
| os.chmod(target_path, 0o640) | |
| print(f"[SUCCESS] .htpasswd created successfully at {target_path} for user '{username}'.") | |
| except Exception as e: | |
| print(f"[ERROR] Failed to write {target_path}: {e}", file=sys.stderr) | |
| sys.exit(1) | |
| if __name__ == "__main__": | |
| generate_htpasswd() | |