Configuration & secrets

Loading model

At runtime configuration is a single settings object built by Dynaconf from two generated files:

from dynaconf import Dynaconf
settings = Dynaconf(environments=True, settings_files=['config/.secrets.json', 'config/settings.json'])
File Produced by Contents

config/settings.json

settings_setup.py

Non-secret, per-environment configuration.

config/.secrets.json

config_setup.py

Secrets fetched from AWS Secrets Manager.

Neither file is committed. ENV_FOR_DYNACONF selects which environment block Dynaconf reads and must equal ENV_NAME. Import the object anywhere as from config.config import settings.

Application code reads configuration only through settings — never os.getenv, never a hardcoded URL, table name or account id. New non-secret values go in settings_setup.py; new secrets go into the automatic_uw_tool Secrets Manager entry (see below).

settings_setup.py

Reads ENV_NAME (required, else ValueError) and writes config/settings.json with a default block plus one environment block. release is production; every other name is a dev environment with environment-suffixed resources and vendor sandboxes.

The default block holds environment-independent values: ENV_NAME, PROJECT_NAME, ENTRUST_API_URL, ENTRUST_WORKFLOW_ID, the Thomson Reuters permissible-purpose codes and certificate paths, the SWF coordinates, and SENTRY_DSN.

For non-release environments a numeric GCI is derived from the environment name (__generate_gci — the first six digits of its SHA-1 hex digest) and used as B2B_TASK_MANAGER_GCI; production uses 1.

The full list of keys, with production and dev values, is in Settings & secrets reference.

config_setup.py

Runs during the build (and locally via make secrets); needs AWS credentials. It selects production versus dev from its first argument — production when invoked as python config_setup.py codepipeline/automatic-uw-tool (CodeBuild passes $CODEBUILD_INITIATOR), otherwise dev.

Secrets Manager entry Becomes

automatic_uw_tool

The whole of config/.secrets.json. Every key added to this secret is written verbatim and becomes settings.<KEY>.

prod/au10tix/token or test/au10tix/token

AU10TIX_TOKEN inside .secrets.json.

/thomsonreuters/s2s/production/v3 (prod)

config/thomson_reuters/file.pfx.base64 + pfx_password.txt, which the build converts to cert.pem / key.pem with openssl.

thomsonreuters/s2s/test (dev)

config/thomson_reuters/cert.pem and key.pem written directly (the secret stores the already-extracted PEMs under crt.pem / key.pem, with escaped newlines restored).

Thomson Reuters secrets are referenced by name, not ARN: a bare name resolves within the caller’s account and region and stays stable across rotation, whereas the ARN’s 6-character suffix changes. The two environments live in different AWS accounts, which the ambient credentials already select.

Secrets consumed at runtime

Secret Used by

AU10TIX_TOKEN

Au10tix client

THOMSON_REUTERS_USER, THOMSON_REUTERS_PASSWORD

CLEAR client (plus the PEM cert/key on disk)

PAYABILITY_AUTH_TOKEN

PybApiAuth in every internal client — exchanged for an X-Session-Token (carrying PermCode.INT_LOGIN, which the document-upload route requires)

ENTRUST_TOKEN

Entrust/Onfido client

ENTRUST_WEBHOOK_TOKEN

The X-SHA2-Signature HMAC on POST /entrust/webhook

HUBSPOT_PRIVATE_APP_TOKEN

HubSpot client

EVENT_LOGGER_KEY

Supplier event logger — with the non-secret EVENT_LOGGER_URL / EVENT_LOGGER_INSTANCE_ID

Environments

Env ENV_NAME AWS account Notes

Dev

any dev slug

605668041275

Vendor sandboxes, environment-suffixed resources, /docs enabled.

Prod

release

625663093496

Live vendors, /docs disabled, app mounted at /.

Selected differences:

Setting release dev (<env>)

THOMSON_REUTERS_API_URL

s2s.thomsonreuters.com/api

s2s.beta.thomsonreuters.com/api

AU10TIX_API_URL

payability.au10tixservices.com/Au10tixBos4

payability.au10tixservicesstaging.com/Au10tixBos4

SWF_DOMAIN

B2B

<env>

S3_DATALAKE_BUCKET

payability-datalake

dev-payability-datalake

EVENT_BUS_NAME

prod_workers

<env>

EVENT_LOGGER_URL

api.payability.com/eventlogger/

an API Gateway stage URL

*_TABLE_NAME

automatic-uw-tool-*

automatic-uw-tool-*-<env>

FAST_API_DOCS_URL / _REDOC_URL

None

/docs / /redoc

FAST_API_ROOT_PATH

/

/automatic-uw-tool-web-api

FAST_API_CORS_ALLOW_ORIGIN

.*.payability.com

.*.dev.payability.com

B2B_TASK_MANAGER_GCI

1

SHA-1-derived digits

ENTRUST_API_URL and ENTRUST_WORKFLOW_ID are currently the same in both environments (they live in the default block), so a dev environment exercises the real Onfido workflow with whatever ENTRUST_TOKEN its account’s secret provides.

Gotchas

  • ENV_FOR_DYNACONF must match ENV_NAME. If they diverge, Dynaconf silently falls back to default-only values — you will see missing-attribute errors for anything environment-specific.

  • Generated files are not editable configuration. Change settings_setup.py or the Secrets Manager entry and regenerate; do not hand-edit settings.json for a deploy.

  • release is production. Any other ENV_NAME is treated as dev.

  • The TR certificate must exist before the client is constructed — ThomsonReutersClient resolves the cert/key paths in init, and any handler that builds a TaskFactory constructs one, so a missing PEM breaks endpoints that never touch Thomson Reuters.

  • A missing secret surfaces late. settings.SOME_KEY raises only when first read, which for webhook secrets means at delivery time — ENTRUST_WEBHOOK_TOKEN is read defensively with getattr(settings, …, None) and logged as a configuration error rather than crashing.