simplefe

commit 1907d13e63d964f4d1de25f6e51938092863134f
parent ba532710a4d069f459d29c35855364192d21a5b5
Author: Chris Roberts <chris.roberts@learningunix.net>
Date:   Fri, 17 Jul 2026 10:12:02 -0500

Load secrets from .env via python-dotenv

Closes the pre-exposure gate: hardcoded Jellyfin/Pushover secrets in .scripts/rip and .scripts/notify now read from environment variables, sourced from a gitignored project-root .env loaded at app startup.

Diffstat:
M
.gitignore
 | 
1
+
M
pyproject.toml
 | 
2
+-
M
src/simplefe/app.py
 | 
3
+++

3 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/.gitignore b/.gitignore
@@ -5,3 +5,4 @@ __pycache__/
 .claude/settings.local.json
 .scripts
 jobs.toml
+.env
diff --git a/pyproject.toml b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 name = "simplefe"
 version = "0.1.0"
 requires-python = ">=3.11"
-dependencies = ["flask", "pexpect",]
+dependencies = ["flask", "pexpect", "python-dotenv"]
 [project.optional-dependencies]
 test = ["pytest"]
 
diff --git a/src/simplefe/app.py b/src/simplefe/app.py
@@ -1,3 +1,5 @@
+from dotenv import load_dotenv
+
 from flask import Flask, abort, request
 
 from simplefe.auth import check_token, load_token
@@ -10,6 +12,7 @@ EXEMPT_PATHS = {"/"}
 
 
 def create_app(jobs=None, token=None):
+    load_dotenv()
     app = Flask(__name__)
 
     if jobs is None: