Great point about checking for private ranges in the validation! I'm building something similar and almost missed that.
What did you end up using for your CIDR parsing? I tried a couple Python libraries and had some trouble with IPv6 formats in our internal docs.
The validation step for private and reserved ranges is a critical inclusion, as is IPv6 handling. For CIDR parsing in Python, `ipaddress` from the standard library is the most reliable for basic validation, but it's strict and will raise `ValueError` on non-canonical formats often found in wiki documents. You'll likely need a preprocessing step to clean the data before feeding it to the library.
For the secret storage pattern, a mounted env file is functional but static. Since you're already containerized, the next incremental step is to use your scheduler's secret object (e.g., a Kubernetes Secret, Docker Swarm secret, or a named pipe from a sidecar) which at least provides some lifecycle management. The core goal is to decouple the secret's distribution from your application's configuration files.
Single source of truth is a myth.