mrcharles
47343d53a2
Route every compile/vet/test path through a digest-pinned golang:1.26
builder container (dev.sh + Makefile) so the host never runs a Go
toolchain. Add an end-to-end smoke that serves keyproxy in a container
with a throwaway config and drives 401/200/404/400/501/405 paths with
python urllib, asserting the server log is redacted. Ship a commented
keyproxy.toml.example (the real config stays gitignored along with any
*.env tripwire) and rewrite the README as the full quickstart, config,
HTTP, CLI, and redaction reference.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
48 lines
1.7 KiB
TOML
48 lines
1.7 KiB
TOML
# keyproxy.toml.example — copy to keyproxy.toml and fill in.
|
|
# keyproxy.toml is gitignored; it holds the ref MAP (paths + key names),
|
|
# never material itself. Refs are mpk-<name> placeholders: consumers see
|
|
# only these names; material resolves at request time, memory-only.
|
|
|
|
# HTTP hop bind address. Keep it loopback unless you know why not.
|
|
listen = "127.0.0.1:8082"
|
|
|
|
[auth]
|
|
# Bearer token for POST /v1/resolve, bootstrapped from the file backend
|
|
# itself: a 0600 env file holding the token. Resolved once at startup,
|
|
# never logged, never persisted by keyproxy.
|
|
token_ref = "mpk-keyproxy-self"
|
|
|
|
# --- file backend: KEY=VALUE env files, 0600, parsed in Go (never
|
|
# sourced/exec'd). mode is the allowed permission mask (default 0600;
|
|
# stricter files like 0400 always pass, looser files are refused).
|
|
[refs."mpk-keyproxy-self"]
|
|
backend = "file"
|
|
source = "~/.config/keyproxy/keyproxy.env"
|
|
key = "KEYPROXY_TOKEN"
|
|
|
|
[refs."mpk-example"]
|
|
backend = "file"
|
|
source = "~/.config/keyproxy/example.env"
|
|
key = "EXAMPLE_API_KEY"
|
|
|
|
# --- env backend: process-environment indirection. source IS the
|
|
# variable name (no key field); useful for container-injected values.
|
|
[refs."mpk-example-env"]
|
|
backend = "env"
|
|
source = "EXAMPLE_API_KEY"
|
|
|
|
# --- bitwarden backend: Bitwarden Secrets Manager REST (machine
|
|
# accounts). NOT IMPLEMENTED in v0 — resolves fail loudly with 501
|
|
# not_implemented so phase 3 is a drop-in behind the same interface.
|
|
[refs."mpk-example-bitwarden"]
|
|
backend = "bitwarden"
|
|
source = "sm://projects/example"
|
|
key = "EXAMPLE_API_KEY"
|
|
|
|
# --- vault backend: HashiCorp Vault KV v2 + AppRole. NOT IMPLEMENTED in
|
|
# v0 — same explicit 501 stub as bitwarden.
|
|
[refs."mpk-example-vault"]
|
|
backend = "vault"
|
|
source = "secret/data/example"
|
|
key = "EXAMPLE_API_KEY"
|