feat: add django-aqueduct typed settings for edx-platform K8s deployments

.pre-commit-config.yaml

@@ -0,0 +1,120 @@
+---
+# See https://pre-commit.com for more information
+# See https://pre-commit.com/hooks.html for more hooks
+ci:
+  skip:
+  - packer_fmt
+  - hadolint-docker
+repos:
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v6.0.0
+  hooks:
+  - id: trailing-whitespace
+  - id: end-of-file-fixer
+  - id: check-yaml
+    exclude: |
+      (?x)(
+        src/ol_infrastructure/infrastructure/aws/eks/files/|
+        src/ol_infrastructure/applications/edxapp/files/edxapp/.*/.*\.yaml|
+        charts/|
+        sdk/
+      )
+  - id: check-added-large-files
+  - id: check-merge-conflict
+  - id: check-toml
+  - id: debug-statements
+- repo: https://github.com/jumanjihouse/pre-commit-hook-yamlfmt
+  rev: 0.2.3
+  hooks:
+  - id: yamlfmt
+    args:
+    - --mapping
+    - '2'
+    - --sequence
+    - '2'
+    - --offset
+    - '0'
+    - --width
+    - '80'
+    - --preserve-quotes
+    exclude: |
+      (?x)(
+        src/ol_infrastructure/applications/edxapp/files/edxapp/.*/.*\.yaml|
+        charts/|
+        sdk/
+      )
+- repo: https://github.com/adrienverge/yamllint.git
+  rev: v1.38.0
+  hooks:
+  - id: yamllint
+    args: [--format, parsable, -d, relaxed]
+    exclude: |
+      (?x)(
+        src/ol_infrastructure/applications/edxapp/files/edxapp/.*/.*\.yaml|
+        charts/|
+        sdk/
+      )
+- repo: https://github.com/Yelp/detect-secrets
+  rev: v1.5.0
+  hooks:
+  - id: detect-secrets
+    args:
+    - --exclude-lines
+    - '(^encryptedkey:|^secure:|^secretsprovider:)'
+    - --exclude-files
+    - src/bridge/secrets/
+    - --exclude-files
+    - poetry.lock
+    - --exclude-files
+    - src/ol_infrastructure/applications/ocw_site/redirect_dict
+    - --exclude-files
+    - charts/
+    - --exclude-files
+    - settings/.*/models/aqueduct\.py
+    - --exclude-files
+    - settings/models/base\.py
+- repo: https://github.com/astral-sh/ruff-pre-commit
+  # Ruff version.
+  rev: 'v0.14.14'
+  hooks:
+  - id: ruff-format
+  - id: ruff-check
+    args: [--extend-ignore=D1, --fix]
+- repo: https://github.com/pre-commit/mirrors-mypy
+  rev: v1.19.1
+  hooks:
+  - id: mypy
+    exclude: |
+      (?x)(
+        dockerfiles/|
+        settings/|
+        src/lehrer/|
+        sdk/
+      )
+    args:
+    - --explicit-package-bases
+    - --namespace-packages
+    - --config-file=pyproject.toml
+    - --warn-unused-configs
+    additional_dependencies:
+    - pydantic>2.10
+    - types-PyYAML
+    - types-requests
+- repo: https://github.com/shellcheck-py/shellcheck-py
+  rev: v0.11.0.1
+  hooks:
+  - id: shellcheck
+- repo: https://github.com/rhysd/actionlint
+  rev: v1.7.10
+  hooks:
+  - id: actionlint
+    name: actionlint
+    description: Runs actionlint to lint GitHub Actions workflow files
+- repo: https://github.com/mitodl/pre-commit-packer
+  rev: v0.0.3
+  hooks:
+  - id: packer_fmt
+- repo: https://github.com/hadolint/hadolint
+  rev: v2.14.0
+  hooks:
+  - id: hadolint-docker

README.md

@@ -410,7 +410,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: Build and publish
         uses: dagger/dagger-for-github@v5
         with:

pip_package_lists/master/mitx-staging.txt

@@ -15,7 +15,8 @@ ol-openedx-rapid-response-reports==0.4.0
 ol-openedx-sentry==0.3.0
 openedx-scorm-xblock>=19.0.1,<19.1.0
 pip==25.3
-pydantic-settings==2.13.1
+pydantic-settings[yaml]==2.13.1
+django-aqueduct==0.3.0
 rapid-response-xblock==0.11.0
 
 # Experimental Plugins for AI features

pip_package_lists/master/mitx.txt

@@ -15,7 +15,8 @@ ol-openedx-rapid-response-reports==0.4.0
 ol-openedx-sentry==0.3.0
 openedx-scorm-xblock>=19.0.1,<19.1.0
 pip==25.3
-pydantic-settings==2.13.1
+pydantic-settings[yaml]==2.13.1
+django-aqueduct==0.3.0
 rapid-response-xblock==0.11.0
 
 # Experimental Plugins for AI features

pip_package_lists/master/mitxonline.txt

@@ -14,7 +14,8 @@ ol-openedx-logging
 ol-openedx-sentry
 openedx-scorm-xblock
 ol-social-auth==0.2.2
-pydantic-settings==2.13.1
+pydantic-settings[yaml]==2.13.1
+django-aqueduct==0.3.0
 
 # Experimental Plugins for AI features
 ol-openedx-chat

pip_package_lists/teak/mitx-staging.txt

@@ -15,7 +15,8 @@ ol-openedx-rapid-response-reports==0.4.0
 ol-openedx-sentry==0.3.0
 openedx-scorm-xblock>=19.0.1,<19.1.0
 pip==25.3
-pydantic-settings==2.12.0
+pydantic-settings[yaml]==2.12.0
+django-aqueduct==0.3.0
 rapid-response-xblock==0.11.0
 
 # Experimental Plugins for AI features

pip_package_lists/teak/mitx.txt

@@ -15,7 +15,8 @@ ol-openedx-rapid-response-reports==0.4.0
 ol-openedx-sentry==0.3.0
 openedx-scorm-xblock>=19.0.1,<19.1.0
 pip==25.3
-pydantic-settings==2.12.0
+pydantic-settings[yaml]==2.12.0
+django-aqueduct==0.3.0
 rapid-response-xblock==0.11.0
 
 # Experimental Plugins for AI features

pip_package_lists/teak/xpro.txt

@@ -14,7 +14,8 @@ ol-openedx-logging
 ol-openedx-sentry
 ol-social-auth
 openedx-scorm-xblock
-pydantic-settings==2.12.0
+pydantic-settings[yaml]==2.12.0
+django-aqueduct==0.3.0
 ol-openedx-chat
 
 # Open Telemetry support

pip_package_lists/ulmo/mitx-staging.txt

@@ -15,7 +15,8 @@ ol-openedx-rapid-response-reports==0.4.0
 ol-openedx-sentry==0.3.0
 openedx-scorm-xblock>=19.0.1,<19.1.0
 pip==25.3
-pydantic-settings==2.13.1
+pydantic-settings[yaml]==2.13.1
+django-aqueduct==0.3.0
 rapid-response-xblock==0.11.0
 
 # Experimental Plugins for AI features

pip_package_lists/ulmo/mitx.txt

@@ -15,7 +15,8 @@ ol-openedx-rapid-response-reports==0.4.0
 ol-openedx-sentry==0.3.0
 openedx-scorm-xblock>=19.0.1,<19.1.0
 pip==25.3
-pydantic-settings==2.13.1
+pydantic-settings[yaml]==2.13.1
+django-aqueduct==0.3.0
 rapid-response-xblock==0.11.0
 
 # Experimental Plugins for AI features

pip_package_lists/ulmo/xpro.txt

@@ -14,7 +14,8 @@ ol-openedx-logging
 ol-openedx-sentry
 ol-social-auth
 openedx-scorm-xblock
-pydantic-settings==2.13.1
+pydantic-settings[yaml]==2.13.1
+django-aqueduct==0.3.0
 ol-openedx-chat
 ol-openedx-chat-xblock
 

pip_package_lists/verawood/mitx-staging.txt

@@ -15,7 +15,8 @@ ol-openedx-rapid-response-reports==0.4.0
 ol-openedx-sentry==0.3.0
 openedx-scorm-xblock>=19.0.1,<19.1.0
 pip==25.3
-pydantic-settings==2.13.1
+pydantic-settings[yaml]==2.13.1
+django-aqueduct==0.3.0
 rapid-response-xblock==0.11.0
 
 # Experimental Plugins for AI features

pip_package_lists/verawood/mitx.txt

@@ -15,7 +15,8 @@ ol-openedx-rapid-response-reports==0.4.0
 ol-openedx-sentry==0.3.0
 openedx-scorm-xblock>=19.0.1,<19.1.0
 pip==25.3
-pydantic-settings==2.13.1
+pydantic-settings[yaml]==2.13.1
+django-aqueduct==0.3.0
 rapid-response-xblock==0.11.0
 
 # Experimental Plugins for AI features

pip_package_lists/verawood/xpro.txt

@@ -14,7 +14,8 @@ ol-openedx-logging
 ol-openedx-sentry
 ol-social-auth
 openedx-scorm-xblock
-pydantic-settings==2.13.1
+pydantic-settings[yaml]==2.13.1
+django-aqueduct==0.3.0
 ol-openedx-chat
 ol-openedx-chat-xblock
 

pyproject.toml

@@ -2,9 +2,7 @@
 name = "lehrer"
 version = "0.1.0"
 requires-python = ">=3.13"
-dependencies = [
-    "dagger-io",
-]
+dependencies = ["dagger-io"]
 license = "BSD-3-Clause"
 
 [build-system]
@@ -21,3 +19,14 @@ exclude = [
   # inside the edx-platform container at runtime, not in lehrer's own venv.
   "settings/",
 ]
+
+[tool.ruff.lint.per-file-ignores]
+# settings/ contains three kinds of files that deliberately break ruff defaults:
+#
+#   assets.py / i18n.py        — use `from ..common import *` (F403) and reference
+#                                names imported by that star import (F405/F401).
+#
+#   process_scheduled_emails.py / saml_pull.py
+#                              — setup() must be called before Django imports;
+#                                E402 (module-level import not at top) is intentional.
+"settings/**" = ["E402", "F401", "F403", "F405"]

settings/cms/aqueduct.py

@@ -0,0 +1,48 @@
+"""CMS (Studio) production settings module — django-aqueduct entry point.
+
+Injected by the lehrer Dagger build into:
+  /openedx/edx-platform/cms/envs/aqueduct.py
+
+Usage::
+
+    DJANGO_SETTINGS_MODULE=cms.envs.aqueduct
+
+The typed pydantic model that backs this module lives alongside it at
+``cms.envs.models.aqueduct`` (generated from the running platform via
+``manage.py generate_aqueduct_settings``).  Update that model by running
+the command inside the Docker image and committing the result to lehrer::
+
+    DJANGO_SETTINGS_MODULE=cms.envs.aqueduct \\
+        python manage.py generate_aqueduct_settings \\
+        --output cms/envs/models/aqueduct.py
+
+Loading strategy (highest → lowest priority):
+
+1. Environment variables — flat scalars from K8s ``envFrom`` ConfigMaps
+   and Secrets.
+2. YAML files under ``OL_SETTINGS_DIR`` (sorted, deep-merged) — complex
+   types such as ``DATABASES``, ``CACHES``, ``JWT_AUTH``, ``FEATURES``.
+3. ``AqueductSettings`` field defaults from ``cms.envs.models.aqueduct``.
+"""
+
+from __future__ import annotations
+
+from pydantic import model_validator
+
+from django_aqueduct import configure_django_settings
+
+from .models.aqueduct import AqueductSettings
+from .models.base import ProductionSettingsMixin
+
+
+class CMSProductionSettings(ProductionSettingsMixin, AqueductSettings):
+    """Typed CMS (Studio) production settings."""
+
+    @model_validator(mode="after")
+    def _derive_urlconf(self) -> CMSProductionSettings:
+        if getattr(self, "ROOT_URLCONF", None) is None:
+            self.ROOT_URLCONF = "cms.urls"  # type: ignore[attr-defined]
+        return self
+
+
+configure_django_settings(CMSProductionSettings)

settings/cms/assets.py

@@ -2,6 +2,7 @@
 """
 Bare minimum settings for collecting production assets.
 """
+
 from ..common import *
 from openedx.core.lib.derived import derive_settings
 
@@ -19,7 +20,7 @@
     "default": {},
 }
 
-LMS_ROOT_URL = 'lms.example.com'
+LMS_ROOT_URL = "lms.example.com"
 
 derive_settings(__name__)
 

settings/cms/i18n.py

@@ -12,7 +12,7 @@
     "default": {},
 }
 
-LMS_ROOT_URL = 'lms.example.com'
+LMS_ROOT_URL = "lms.example.com"
 
 derive_settings(__name__)