50 lines
2.6 KiB
Markdown
50 lines
2.6 KiB
Markdown
# TASK: keyproxy v0 — file backend (mpk_ placeholder interface, live)
|
|
|
|
## Context
|
|
Charles (2026-08-28 ~21:30): the credential gateway is key infrastructure.
|
|
This account has NO Bitwarden access, so v0 runs on a FILE backend over
|
|
~/.creds-style env files. The `mpk_...` placeholder interface ships NOW;
|
|
Bitwarden REST + Vault KV v2/AppRole backends swap in later behind the same
|
|
interface (phase 3, already specced in the repo README — read it first).
|
|
Consumers only ever see `mpk-<name>` refs; real material crosses the wire
|
|
at resolve time, memory-only, never persisted, never logged.
|
|
|
|
## Scope
|
|
1. Clone `https://git.knownelement.com/ukrrs/mopac-keyproxy` to
|
|
`~/projects/meta/MOPAC/keyproxy` (spec README + LICENSE already there).
|
|
2. Implement v0 in Go (stdlib only):
|
|
- `keyproxy serve` — localhost HTTP (default :8082, configurable):
|
|
`POST /v1/resolve` body `{"ref":"mpk-redmine"}` → `{"value":"..."}`
|
|
(mask value in any log line as `mpk-redmine=***`).
|
|
- Backends behind one interface:
|
|
- `file:` — env-file format (KEY=VALUE lines, 0600) at a configured
|
|
path; ref maps to file+key. Sources tonight: `~/.creds/redmine.env`,
|
|
`/home/_crossfeed/tooling/credentials/litellm-secrets.env`,
|
|
`~/.coordinate/secrets/mopac-harness-vkey.env`.
|
|
- `env:` — process env indirection.
|
|
- `bitwarden:` / `vault:` — stubs returning explicit "not implemented
|
|
in v0" errors (interface + tests only, so phase 3 is a drop-in).
|
|
- Auth: bearer token for /v1/resolve, bootstrapped from the file backend
|
|
itself (a `mpk-keyproxy-self` entry), 0600 file, never logged.
|
|
- Config: `keyproxy.toml` — port + ref map (ref → backend/source/key).
|
|
`keyproxy.toml.example` tracked; real config gitignored.
|
|
3. Rules (non-negotiable, from DESIGN.md keyproxy section):
|
|
- No admin UI. No persistence. No key material in logs, errors, or
|
|
crash paths (assert redaction in tests).
|
|
- Never exec() env files; parse KEY=VALUE in Go.
|
|
- Resolution failures name the ref and backend, never the value.
|
|
|
|
## Build discipline
|
|
- ALL DEV IN DOCKER: digest-pinned golang:1.26 builder container, repo
|
|
bind-mounted; Makefile targets (build/vet/test) route through docker run.
|
|
No host Go toolchain use.
|
|
|
|
## Deliverables
|
|
- Commits pushed to ukrrs/mopac-keyproxy main.
|
|
- Docs per standard (Charles's decree): README quickstart with verified
|
|
copy-paste curl-equivalent (python3 urllib) resolve example, config
|
|
reference table, status table.
|
|
- Table-driven tests incl. redaction + fake-HTTP end-to-end.
|
|
- `REPORT-20260828-2130-keyproxy-v0.md` in `~/.coordinate/inbox-pmo/`:
|
|
what runs, how to start it, the ref map seeded, stub status.
|