Adding the new rewrite

app/settings.py

@@ -0,0 +1,81 @@
+"""Centralized settings loaded once at startup via pydantic-settings.
+
+Reads environment variables once and exposes a cached Settings() instance.
+Replaces scattered os.environ.get() calls throughout the codebase.
+"""
+from __future__ import annotations
+
+from functools import lru_cache
+
+from pydantic import Field
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    """Application settings pulled from environment variables."""
+
+    model_config = SettingsConfigDict(
+        env_file=".env",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+        extra="ignore",
+    )
+
+    # Redis
+    redis_url: str = Field(
+        default="redis://redis:6379/0", description="Redis connection URL"
+    )
+
+    # Auth
+    admin_username: str = Field(default="admin", description="Admin username")
+    admin_password_hash: str | None = Field(
+        default=None,
+        description="Argon2 password hash. If unset, first-run setup is required.",
+    )
+    session_secret: str | None = Field(
+        default=None,
+        description="Signing secret for session cookies (required in prod).",
+    )
+    session_max_age_seconds: int = Field(
+        default=14 * 24 * 3600, description="Session cookie max age"
+    )
+    trust_proxy: bool = Field(
+        default=False,
+        description="Set true when behind HTTPS reverse proxy (enables Secure cookie + HSTS)",
+    )
+
+    # SMTP
+    smtp_password: str | None = Field(
+        default=None, description="SMTP password (not stored in Redis)"
+    )
+
+    # Network validation
+    allow_private_ips: bool = Field(
+        default=True,
+        description="Allow private/RFC1918 hosts in UPSConfig.host. Default true for homelab.",
+    )
+
+    # Legacy / migration
+    ups_config_path: str = Field(
+        default="/config/ups.yaml",
+        description="Legacy YAML path (migration-only).",
+    )
+
+    # Logging
+    log_level: str = Field(default="INFO", description="Python log level")
+
+    # Timezone
+    tz: str = Field(default="UTC", description="Server timezone")
+
+    # Rate limit toggle (disable in tests)
+    rate_limit_enabled: bool = Field(
+        default=True, description="Enable slowapi rate limiting"
+    )
+
+
+@lru_cache(maxsize=1)
+def get_settings() -> Settings:
+    return Settings()
+
+
+settings = get_settings()