SEP-1800: Support a global DATABASE settings block that per-service *__DATABASE__* names override

[peter-o-addo]

Summary

Give per-service settings names deterministic priority over global unprefixed ones, and document one shared DATABASE mount for the PMM side-car.

• app/core/config.py : split the prefix-strip rewrite into unprefixed and prefixed buckets so {SEP,INVENTORY,TASKS}__* beats the global spelling within each source
• sidecar/settings.yaml : define DATABASE once with a YAML anchor and alias it from SEP, INVENTORY, and TASKS
• sidecar/README.md, README.md : document global DATABASE__PASSWORD, per-service override precedence, and the updated side-car mount recipe
• changelog.d/SEP-1800.config.md : add configuration changelog entry for operators
• tests/app/core/test_config.py, tests/sidecar/test_embedded_settings.py, tests/sidecar/test_settings_env.py : add precedence and profile coverage; update one settings-env docstring

Tested

• Set DATABASE__PASSWORD and SEP__DATABASE__PASSWORD in both orderings and confirm SEP always resolves seppw.
• Mount only DATABASE__PASSWORD and confirm SEP, Inventory, and Tasks all resolve the same password.
• Mount both DATABASE__PASSWORD and SEP__DATABASE__PASSWORD and confirm SEP uses the per-service value.
• Set only SEP__DATABASE__PASSWORD and confirm Inventory does not read it.
• Mount DATABASE__PASSWORD with the side-car profile and confirm the Celery beat store URI uses that password.
• Confirm sidecar/settings.yaml defines DATABASE once and all three services resolve the same host, name, and port.

Checklist

• New/modified functions have type hints and rST docstrings
• New tests added for new features or bug fixes
• All tests pass locally (make test)
• Pre-commit hooks pass (make run-pre-commit)
• Database migrations generated if models changed (make makemigrations)
• User-facing changes documented (README, inline help, UI text)
• Configuration changes documented with examples
• Changelog fragment added under changelog.d/ if the change is user-facing (make changelog-add), or confirmed N/A (internal-only change, or a same-release-cycle fix for an unreleased sibling ticket)

[peter-o-addo]

1 — Per-service env beats global, regardless of order

Set both DATABASE__PASSWORD=globalpw and SEP__DATABASE__PASSWORD=seppw, then loaded
SEPSettings() with the global variable set first, then with the per-service variable
set first.

global-first: seppw
per-service-first: seppw

---

2 — One global secret file supplies all three services

Mounted only /tmp/sep1800/secrets/DATABASE__PASSWORD (shared-pw) and loaded
SEPSettings, InventorySettings, and TasksSettings with _secrets_dir pointing at
that directory.

SEPSettings shared-pw
InventorySettings shared-pw
TasksSettings shared-pw

---

3 — Per-service secret file overrides global

Mounted both DATABASE__PASSWORD (globalpw) and SEP__DATABASE__PASSWORD (seppw),
then loaded SEPSettings from that secrets directory.

SEP: seppw

---

4 — Foreign prefix is invisible to another service

Set only SEP__DATABASE__PASSWORD=sep-pw in the environment and loaded
InventorySettings() (no global or Inventory-prefixed password).

Inventory: None

---

5 — Celery beat URI picks up the global mounted password

Mounted DATABASE__PASSWORD (beatpw), ran with the side-car profile, and read
Settings(_secrets_dir=...).CELERY.beat_dburi.

beat: postgresql+psycopg2://sep:beatpw@pmm-server:5432/sep

---

6 — Side-car profile defines DATABASE once; all services resolve the same connection

Parsed sidecar/settings.yaml to confirm the YAML anchor is shared, then loaded all three
settings classes against the embedded profile.

same object: True
block: {'ENGINE': 'postgresql', 'HOST': 'pmm-server', 'NAME': 'sep', 'PORT': 5432, 'USER': 'sep'}
SEPSettings pmm-server sep 5432
InventorySettings pmm-server sep 5432
TasksSettings pmm-server sep 5432

[Copilot]

Pull request overview

Adds deterministic per-service precedence over global database settings and supports one shared side-car database password mount.

Changes:

• Separates global and prefixed settings before merging.
• Shares side-car database configuration through YAML aliases.
• Adds precedence/profile tests and operator documentation.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
app/core/config.py	Implements prefixed-key precedence.
sidecar/settings.yaml	Defines one shared database block.
README.md	Documents global settings resolution.
sidecar/README.md	Updates side-car mount guidance.
changelog.d/SEP-1800.config.md	Adds the operator-facing change note.
tests/app/core/test_config.py	Tests source precedence and global passwords.
tests/sidecar/test_embedded_settings.py	Tests the shared embedded profile.
tests/sidecar/test_settings_env.py	Clarifies shell-export behavior.

Suppressed comments (1)

app/core/config.py:317

• Update settings_customise_sources’s docstring to describe the new collision rule: prefixed keys override unprefixed keys within each environment, dotenv, or secret-file source, while the existing source ordering still wins across sources. Without that distinction, callers cannot infer the actual precedence contract from this shared API.

                unprefixed: dict[str, Any] = {}
                prefixed: dict[str, Any] = {}
                for key, value in env_source.env_vars.items():
                    stripped = prefix_pattern.sub(r"\1", key)
                    (unprefixed if stripped == key else prefixed)[stripped] = value
                env_source.env_vars = {**unprefixed, **prefixed}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
app/core
config.py
app/sep/sync/syncers
pmm.py
Project Total

This report was generated by python-coverage-comment-action