fix(general): Remove grains.get_or_set_hash use

since it was removed in v3005

gitea/post-map.jinja

@@ -3,13 +3,13 @@
 
 {#- If latest was specified, query the official download server for the latest version. -#}
 
-{%- if 'latest' == mapdata.version -%}
-  {%- set latest = salt['http.query'](
+{%- if "latest" == mapdata.version -%}
+  {%- set latest = salt["http.query"](
         mapdata.lookup.pkg.latest,
-        decode=True, decode_type='json'
-      )['dict']['latest']['version']
+        decode=True, decode_type="json"
+      )["dict"]["latest"]["version"]
   -%}
-  {%- do mapdata.update({'version': latest}) -%}
+  {%- do mapdata.update({"version": latest}) -%}
 {%- endif -%}
 
 
@@ -25,15 +25,15 @@
 {%- do mapdata.update({"_rw": []}) -%}
 
 {%- for path in [
-      ('app_data_path', 'server', mapdata.lookup.paths.data, mapdata.lookup.paths.work | path_join('data')),
-      ('root_path', 'log', mapdata.lookup.paths.log, mapdata.lookup.paths.work | path_join('log')),
-      ('root', 'repository', mapdata.lookup.paths.repos, mapdata.lookup.paths.data | path_join('gitea-repositories')),
+      ("app_data_path", "server", mapdata.lookup.paths.data, mapdata.lookup.paths.work | path_join("data")),
+      ("root_path", "log", mapdata.lookup.paths.log, mapdata.lookup.paths.work | path_join("log")),
+      ("root", "repository", mapdata.lookup.paths.repos, mapdata.lookup.paths.data | path_join("gitea-repositories")),
     ] -%}
   {%- set var, topic, current, default = path -%}
   {%- if current != default -%}
-    {%- do mapdata | update_dict_key_value('config:' ~ topic, {var: current}) -%}
+    {%- do mapdata | update_dict_key_value("config:" ~ topic, {var: current}) -%}
     {#- log directory is handled in service template -#}
-    {%- if topic != 'log' -%}
+    {%- if topic != "log" -%}
       {%- do mapdata._rw.append(current) -%}
     {%- endif -%}
   {%- endif -%}
@@ -41,44 +41,54 @@
 
 
 {#-
-    If the secrets were not provided, get them from a grain/generate and save them there.
-    This avoids
+    If the secrets were not provided, generate them here. Since grains.get_or_set_hash was
+    removed, there is no easy way to cache the random value to avoid changing it over and over.
+    It cannot be read from `app.ini` since the configparser serializer throws an exception.
+
+    Generating it here avoids
       a) calling the gitea binary in the app.ini template (`gitea generate secret SECRET_KEY`)
       b) and special-casing to avoid regenerating those secrets every run.
 
     The INTERNAL_TOKEN has a special format, but it can be configured to be read from a separate file.
-
-    "." is used in place of ":" to avoid libmapstack automap. @TODO sensible to indulge in that magic?
 -#}
 
+{%- set current_cached = {} -%}
+{%- set cache_updated = false -%}
+{%- set cache_file = mapdata.lookup.paths.conf | path_join(".saltcache.yml") -%}
+{%- if salt["file.file_exists"](cache_file) -%}
+  {%- set current_cached = salt["jinja.import_yaml"](cache_file) -%}
+{%- else -%}
+  {%- do salt["file.mkdir"](mapdata.lookup.paths.conf) -%}
+{%- endif -%}
+{%- for var, val in current_cached.items() -%}
+  {%- do mapdata.config | set_dict_key_value(var, val) -%}
+{%- endfor -%}
 {%- if not mapdata.config | traverse("security:secret_key", "") -%}
-  {%- set secret_key = salt['grains.get_or_set_hash'](
-        'gitea.config.security.secret_key',
-        length=64,
-        chars='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789',
-      )
-  -%}
-  {%- do mapdata.config | update_dict_key_value("security", {"secret_key": secret_key}) -%}
+  {%- do current_cached.update({"security:secret_key": salt["random.get_str"](64, punctuation=false)}) -%}
+  {%- set cache_updated = true -%}
 {%- endif -%}
 
-{%- for jwt in ['oauth2:jwt_secret', 'server:lfs_jwt_secret'] -%}
+{%- for jwt in ["oauth2:jwt_secret", "server:lfs_jwt_secret"] -%}
   {%- if not mapdata.config | traverse(jwt, "") -%}
-    {%- set secret = salt['grains.get_or_set_hash'](
-          'gitea.config.' ~ jwt | replace(":", "."),
-          length=43,
-          chars='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-',
-        )
-    -%}
-    {%- do mapdata.config | update_dict_key_value(jwt.split(":")[0], {jwt.split(":")[1]: secret}) -%}
+    {%- do current_cached.update({jwt: salt["random.get_str"](43, chars="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-")}) -%}
+    {%- set cache_updated = true -%}
   {%- endif -%}
 {%- endfor -%}
 
+{%- if cache_updated -%}
+  {%- for var, val in current_cached.items() -%}
+    {%- do mapdata.config | set_dict_key_value(var, val) -%}
+  {%- endfor -%}
+  {%- do salt["file.write"](cache_file, salt["slsutil.serializer"]("yaml", current_cached)) -%}
+  {%- do salt["file.set_mode"]("0600") -%}
+{%- endif -%}
+
 {%- do mapdata.update({"_generate_token": false}) -%}
 {%- if not mapdata.config | traverse("security:internal_token") -%}
   {%- do mapdata.config | update_dict_key_value("security", {"internal_token_uri": mapdata.lookup.paths.internal_token_uri}) -%}
-  {%- if 'file://' == mapdata.lookup.paths.internal_token_uri[:7] -%}
+  {%- if "file://" == mapdata.lookup.paths.internal_token_uri[:7] -%}
     {%- do mapdata.update({"_generate_token": true}) -%}
-  {%- endif %}
+  {%- endif -%}
 {%- endif -%}
 
 {%- do mapdata.config | update_dict_key_value("security", {"install_lock": true}) -%}