Skip to content

Setup

setup

Interactive credential setup — the axm-vault setup driver.

:func:run_setup walks the discovered credential catalog and, for every spec, prompts the operator for a value and routes it to its store by sensitivity: SECRET values go to the OS keyring (presence is derived by probing the keyring, never recorded as a separate marker), CONFIG values go to axm-config. NONSENSITIVE credentials are environment-only and are never prompted nor stored — storing them would create a second, stale source of truth.

The driver is a genuine process-lifecycle command (it reads from a TTY and blocks on operator input), which is why it lives as a plain function behind the cyclopts CLI rather than as an :class:~axm.tools.base.AXMTool. It refuses to run without a TTY (no silent, non-interactive credential writes) and is idempotent: a blank answer keeps any existing value untouched, so a re-run only fills in what is still missing.

run_setup(only=None)

Prompt for and store every storable credential in the catalog.

Parameters:

Name Type Description Default
only str | None

When given, restrict setup to the single group.name (or a bare name) matching this string; otherwise cover every spec.

 None

The function refuses to run without an interactive TTY (writes :class:SystemExit 1 to stderr). NONSENSITIVE specs are skipped (environment-only); SECRET specs are read with :func:getpass.getpass and CONFIG specs with :func:input. A blank answer keeps the existing value, making the driver idempotent across re-runs.

Source code in packages/axm-vault/src/axm_vault/setup.py
Python
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
def run_setup(only: str | None = None) -> None:
    """Prompt for and store every storable credential in the catalog.

    Args:
        only: When given, restrict setup to the single ``group.name`` (or a
            bare ``name``) matching this string; otherwise cover every spec.

    The function refuses to run without an interactive TTY (writes
    :class:`SystemExit` ``1`` to stderr). NONSENSITIVE specs are skipped
    (environment-only); SECRET specs are read with :func:`getpass.getpass`
    and CONFIG specs with :func:`input`. A blank answer keeps the existing
    value, making the driver idempotent across re-runs.
    """
    if not sys.stdin.isatty():
        print(
            "axm-vault setup requires an interactive terminal (TTY).",
            file=sys.stderr,
        )
        raise SystemExit(1)
    keyring = KeyringStore()
    for group in load_catalog().groups():
        for spec in group.specs:
            if only is not None and only not in (f"{group.id}.{spec.name}", spec.name):
                continue
            _setup_spec(keyring, group, spec)