rewritten after codex recommendations

Config.py

@@ -1,9 +1,62 @@
+"""Runtime configuration for Flowers.
 
-LOGFILE = '/tmp/wsgi_flowers.log'
-DEBUG = 0
-MAXTEXTLEN = 70
-MINFIELDLEN = 3
-INFO = 1
-DONOTSETFILTER = 'DoNotSetFilterinCookie'
-ACCESSFILE = '/tmp/wsgi_flower_accessfile'
-URLPREFIX = ''   #'/flowers'
+Secrets are read from the git-ignored ``secrets.yaml`` file. Environment
+variables take precedence, which is useful for container deployments.
+"""
+
+import os
+import secrets
+from pathlib import Path
+
+import yaml
+
+
+BASE_DIR = Path(__file__).resolve().parent
+SECRETS_FILE = Path(
+    os.getenv("FLOWERS_SECRETS_FILE", str(BASE_DIR / "secrets.yaml"))
+)
+
+
+def _load_secrets(path: Path) -> dict:
+    try:
+        data = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+    except FileNotFoundError:
+        return {}
+    except (OSError, yaml.YAMLError) as exc:
+        raise RuntimeError(f"Could not read Flowers secrets file: {path}") from exc
+    if not isinstance(data, dict):
+        raise RuntimeError(f"Flowers secrets file must contain a mapping: {path}")
+    return data
+
+
+_SECRETS = _load_secrets(SECRETS_FILE)
+_FLASK_SECRETS = _SECRETS.get("flask", {})
+_DATABASE_SECRETS = _SECRETS.get("database", {})
+if not isinstance(_FLASK_SECRETS, dict) or not isinstance(_DATABASE_SECRETS, dict):
+    raise RuntimeError("The flask and database secrets sections must be mappings")
+
+
+LOGFILE = os.getenv("FLOWERS_LOG_FILE", "/tmp/wsgi_flowers.log")
+DEBUG = os.getenv("FLOWERS_DEBUG", "0") == "1"
+INFO = os.getenv("FLOWERS_INFO", "1") == "1"
+MAXTEXTLEN = int(os.getenv("FLOWERS_MAX_TEXT_LENGTH", "70"))
+MINFIELDLEN = int(os.getenv("FLOWERS_MIN_FIELD_LENGTH", "3"))
+DONOTSETFILTER = "DoNotSetFilterinCookie"
+ACCESSFILE = os.getenv("FLOWERS_ACCESS_FILE", "/tmp/wsgi_flower_accessfile")
+URLPREFIX = os.getenv("FLOWERS_URL_PREFIX", "").rstrip("/")
+
+DB_HOST = os.getenv("FLOWERS_DB_HOST", "localhost")
+DB_PORT = int(os.getenv("FLOWERS_DB_PORT", "3306"))
+DB_NAME = os.getenv("FLOWERS_DB_NAME", "Flowers")
+DB_ADMIN_USER = os.getenv("FLOWERS_DB_ADMIN_USER", "flower")
+DB_ADMIN_PASSWORD = os.getenv(
+    "FLOWERS_DB_ADMIN_PASSWORD", str(_DATABASE_SECRETS.get("admin_password", ""))
+)
+
+SESSION_MINUTES = int(os.getenv("FLOWERS_SESSION_MINUTES", "10"))
+SECRET_KEY = (
+    os.getenv("FLOWERS_SECRET_KEY")
+    or str(_FLASK_SECRETS.get("secret_key", ""))
+    or secrets.token_hex(32)
+)
+COOKIE_SECURE = os.getenv("FLOWERS_COOKIE_SECURE", "0") == "1"