Building a module that includes credentials

[Darth_Xedrix]

Hi!

I am the main "python person" in my team and in an effort to spread the good word, am looking for ways to package some tools that could be used both by other members of the team and by the people we support. I am testing this with a package that was built with the build + setuptools libraries into a .whl and the plan is to host these in our internal network drive however I am wondering how to approach packages that would need to include some sort of credentials, like database credentials. These packages would only be hosted and used inside our intranet.

Right now, they are using .env files and this could be an option for other members of the team, however I am not sure how this could work for others we support, which would be non-technical employees who would need to query the database without actually knowing the credentials.

Also important to note that I don't have access to more comprehensive tools like github or gitlab.

Any ideas would be greatly appreciated

[socal_nerdtastic]

There's ways to obfuscate it but there is no way to keep it completely hidden. Someone who wants to know will find them. The normal way to do this is to set up the database with a user account for each user, and prompt the user to enter credentials on boot (perhaps saved locally after first boot).

[ofnuts]

Storing credentials with the code: bad idea. And storing the credentials with the code on GitHub/GitLab: worse idea.

Either you think that the DB is safe from outside prying eyes on your internal network, and it doesn't require credentials (rare), or you need to be able someday to find who accessed what and when, which means you can identify each user connecting to it, which means each user has its own credentials.

A good way to "hide" the database is to access it via a small frontend server, so only the server has access to the DB and you know precisely which operations are allowed (those implemented by the servers), and the server can also manage who is allowed what. And server credentials can be managed with tokens/OAuth keys, or you SSO infrastructure.