mrcharles
47343d53a2
Route every compile/vet/test path through a digest-pinned golang:1.26
builder container (dev.sh + Makefile) so the host never runs a Go
toolchain. Add an end-to-end smoke that serves keyproxy in a container
with a throwaway config and drives 401/200/404/400/501/405 paths with
python urllib, asserting the server log is redacted. Ship a commented
keyproxy.toml.example (the real config stays gitignored along with any
*.env tripwire) and rewrite the README as the full quickstart, config,
HTTP, CLI, and redaction reference.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
95 lines
2.5 KiB
Bash
Executable File
95 lines
2.5 KiB
Bash
Executable File
#!/bin/sh
|
|
# keyproxy end-to-end smoke: builds in the digest-pinned builder, starts
|
|
# `keyproxy serve` in a container on host port 8082 with a throwaway
|
|
# config + throwaway 0600 env files, drives it from the host with python
|
|
# urllib (curl is banned on the host by policy), checks the 401/200/404/
|
|
# 400/501/502 paths AND that the server log is redacted (no material,
|
|
# every ref masked as <ref>=***), then tears everything down.
|
|
set -e
|
|
cd "$(dirname "$0")/.."
|
|
|
|
IMAGE="golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514" # = golang:1.26-bookworm
|
|
NAME="keyproxy-smoke"
|
|
PORT="${PORT:-8082}"
|
|
|
|
./dev.sh build
|
|
|
|
rm -rf .smoke
|
|
mkdir -p .smoke
|
|
chmod 0700 .smoke
|
|
|
|
# Throwaway material (smoke values only; never real secrets).
|
|
cat > .smoke/keyproxy.env <<'EOF'
|
|
KEYPROXY_TOKEN=smoke-bearer-token-1111
|
|
EOF
|
|
cat > .smoke/creds.env <<'EOF'
|
|
API_KEY=smoke-secret-material-2222
|
|
OTHER=smoke-other-3333
|
|
EOF
|
|
chmod 0600 .smoke/keyproxy.env .smoke/creds.env
|
|
|
|
# In-container bind is all-interfaces ONLY because docker -p publishing
|
|
# is the boundary here; the host default (and example config) stays
|
|
# loopback.
|
|
cat > .smoke/keyproxy.toml <<EOF
|
|
listen = ":8082"
|
|
|
|
[auth]
|
|
token_ref = "mpk-keyproxy-self"
|
|
|
|
[refs."mpk-keyproxy-self"]
|
|
backend = "file"
|
|
source = "/h/.smoke/keyproxy.env"
|
|
key = "KEYPROXY_TOKEN"
|
|
|
|
[refs."mpk-smoke"]
|
|
backend = "file"
|
|
source = "/h/.smoke/creds.env"
|
|
key = "API_KEY"
|
|
|
|
[refs."mpk-smoke-env"]
|
|
backend = "env"
|
|
source = "KEYPROXY_SMOKE_ENV"
|
|
|
|
[refs."mpk-smoke-bw"]
|
|
backend = "bitwarden"
|
|
source = "sm://p/smoke"
|
|
key = "API_KEY"
|
|
|
|
[refs."mpk-smoke-vault"]
|
|
backend = "vault"
|
|
source = "secret/data/smoke"
|
|
key = "API_KEY"
|
|
EOF
|
|
|
|
docker rm -f "$NAME" >/dev/null 2>&1 || true
|
|
docker run -d --name "$NAME" -p "$PORT:8082" \
|
|
-v "$PWD:/h" -w /h -u "$(id -u):$(id -g)" -e HOME=/tmp \
|
|
-e KEYPROXY_SMOKE_ENV=smoke-env-material-4444 \
|
|
"$IMAGE" /h/bin/keyproxy serve -config /h/.smoke/keyproxy.toml
|
|
|
|
cleanup() {
|
|
docker rm -f "$NAME" >/dev/null 2>&1 || true
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
echo "--- probing http://127.0.0.1:$PORT (python urllib; curl banned on host) ---"
|
|
BASE_URL="http://127.0.0.1:$PORT" KEYPROXY_TOKEN="smoke-bearer-token-1111" \
|
|
python3 smoke/probe.py
|
|
probe_rc=$?
|
|
|
|
echo "--- server log (redaction check) ---"
|
|
LOG="$(docker logs "$NAME" 2>&1)"
|
|
echo "$LOG"
|
|
|
|
if echo "$LOG" | grep -q 'smoke-secret-material-2222\|smoke-env-material-4444\|smoke-bearer-token-1111'; then
|
|
echo "FAIL: server log contains material"
|
|
exit 1
|
|
fi
|
|
if ! echo "$LOG" | grep -q 'ref=mpk-smoke=\*\*\*'; then
|
|
echo "FAIL: server log does not mask refs as <ref>=***"
|
|
exit 1
|
|
fi
|
|
|
|
exit "$probe_rc"
|