Add support for Hashicorp Vault

Vault is supported for the following:
As a well-known filesystem for TLS cert, TLS key and SSH signing key.
For configuration secrets for cookie_secret, csrf_secret, oauth_client_id and oauth_client_secret options.

1 files changed, 91 insertions, 0 deletions

diff --git a/server/wkfs/vaultfs/vault.go b/server/wkfs/vaultfs/vault.go
new file mode 100644
index 0000000..6f11057
--- /dev/null
+++ b/server/wkfs/vaultfs/vault.go
@@ -0,0 +1,91 @@
+package vaultfs
+
+import (
+	"bytes"
+	"errors"
+	"os"
+	"path"
+	"time"
+
+	"github.com/nsheridan/cashier/server/config"
+	"github.com/nsheridan/cashier/server/helpers/vault"
+	"go4.org/wkfs"
+)
+
+// Register the /vault/ filesystem as a well-known filesystem.
+func Register(vc *config.Vault) {
+	client, err := vault.NewClient(vc.Address, vc.Token)
+	if err != nil {
+		registerBrokenFS(err)
+		return
+	}
+	wkfs.RegisterFS("/vault/", &vaultFS{
+		client: client,
+	})
+}
+
+func registerBrokenFS(err error) {
+	wkfs.RegisterFS("/vault/", &vaultFS{
+		err: err,
+	})
+}
+
+type vaultFS struct {
+	err    error
+	client *vault.Client
+}
+
+// Open opens the named file for reading.
+func (fs *vaultFS) Open(name string) (wkfs.File, error) {
+	secret, err := fs.client.Read(name)
+	if err != nil {
+		return nil, err
+	}
+	return &file{
+		name:   name,
+		Reader: bytes.NewReader([]byte(secret)),
+	}, nil
+}
+
+func (fs *vaultFS) Stat(name string) (os.FileInfo, error) { return fs.Lstat(name) }
+func (fs *vaultFS) Lstat(name string) (os.FileInfo, error) {
+	secret, err := fs.client.Read(name)
+	if err != nil {
+		return nil, err
+	}
+	return &statInfo{
+		name: path.Base(name),
+		size: int64(len(secret)),
+	}, nil
+}
+
+func (fs *vaultFS) MkdirAll(path string, perm os.FileMode) error { return nil }
+
+func (fs *vaultFS) OpenFile(name string, flag int, perm os.FileMode) (wkfs.FileWriter, error) {
+	return nil, errors.New("not implemented")
+}
+
+type statInfo struct {
+	name    string
+	size    int64
+	isDir   bool
+	modtime time.Time
+}
+
+func (si *statInfo) IsDir() bool        { return si.isDir }
+func (si *statInfo) ModTime() time.Time { return si.modtime }
+func (si *statInfo) Mode() os.FileMode  { return 0644 }
+func (si *statInfo) Name() string       { return path.Base(si.name) }
+func (si *statInfo) Size() int64        { return si.size }
+func (si *statInfo) Sys() interface{}   { return nil }
+
+type file struct {
+	name string
+	*bytes.Reader
+}
+
+func (*file) Close() error   { return nil }
+func (f *file) Name() string { return path.Base(f.name) }
+func (f *file) Stat() (os.FileInfo, error) {
+	return nil, errors.New("Stat not implemented on /vault/ files")
+}