From 17cd70cea546e287713a3d4c086528a85abefa2e Mon Sep 17 00:00:00 2001 From: Niall Sheridan Date: Tue, 4 Oct 2016 14:37:01 -0700 Subject: Add support for Hashicorp Vault Vault is supported for the following: As a well-known filesystem for TLS cert, TLS key and SSH signing key. For configuration secrets for cookie_secret, csrf_secret, oauth_client_id and oauth_client_secret options. --- server/wkfs/s3fs/s3.go | 153 +++++++++++++++++++++++++++++++++++++++++++ server/wkfs/vaultfs/vault.go | 91 +++++++++++++++++++++++++ 2 files changed, 244 insertions(+) create mode 100644 server/wkfs/s3fs/s3.go create mode 100644 server/wkfs/vaultfs/vault.go (limited to 'server/wkfs') diff --git a/server/wkfs/s3fs/s3.go b/server/wkfs/s3fs/s3.go new file mode 100644 index 0000000..a71d874 --- /dev/null +++ b/server/wkfs/s3fs/s3.go @@ -0,0 +1,153 @@ +package s3fs + +import ( + "bytes" + "errors" + "io/ioutil" + "os" + "path" + "strings" + "time" + + "go4.org/wkfs" + + "github.com/aws/aws-sdk-go/aws" + "github.com/aws/aws-sdk-go/aws/awserr" + "github.com/aws/aws-sdk-go/aws/credentials" + "github.com/aws/aws-sdk-go/aws/session" + "github.com/aws/aws-sdk-go/service/s3" + "github.com/nsheridan/cashier/server/config" +) + +// Register the /s3/ filesystem as a well-known filesystem. +func Register(config *config.AWS) { + ac := &aws.Config{} + // If region is unset the SDK will attempt to read the region from the environment. + if config.Region != "" { + ac.Region = aws.String(config.Region) + } + // Attempt to get credentials from the cashier config. + // Otherwise check for standard credentials. If neither are present register the fs as broken. + // TODO: implement this as a provider. + if config.AccessKey != "" && config.SecretKey != "" { + ac.Credentials = credentials.NewStaticCredentials(config.AccessKey, config.SecretKey, "") + } else { + _, err := session.New().Config.Credentials.Get() + if err != nil { + registerBrokenFS(errors.New("aws credentials not found")) + return + } + } + sc := s3.New(session.New(ac)) + if aws.StringValue(sc.Config.Region) == "" { + registerBrokenFS(errors.New("aws region configuration not found")) + return + } + wkfs.RegisterFS("/s3/", &s3FS{ + sc: sc, + }) +} + +func registerBrokenFS(err error) { + wkfs.RegisterFS("/s3/", &s3FS{ + err: err, + }) +} + +type s3FS struct { + sc *s3.S3 + err error +} + +func (fs *s3FS) parseName(name string) (bucket, fileName string, err error) { + if fs.err != nil { + return "", "", fs.err + } + name = strings.TrimPrefix(name, "/s3/") + i := strings.Index(name, "/") + if i < 0 { + return name, "", nil + } + return name[:i], name[i+1:], nil +} + +// Open opens the named file for reading. +func (fs *s3FS) Open(name string) (wkfs.File, error) { + bucket, fileName, err := fs.parseName(name) + if err != nil { + return nil, err + } + obj, err := fs.sc.GetObject(&s3.GetObjectInput{ + Bucket: &bucket, + Key: &fileName, + }) + if err != nil { + return nil, err + } + defer obj.Body.Close() + slurp, err := ioutil.ReadAll(obj.Body) + if err != nil { + return nil, err + } + return &file{ + name: name, + Reader: bytes.NewReader(slurp), + }, nil +} + +func (fs *s3FS) Stat(name string) (os.FileInfo, error) { return fs.Lstat(name) } +func (fs *s3FS) Lstat(name string) (os.FileInfo, error) { + bucket, fileName, err := fs.parseName(name) + if err != nil { + return nil, err + } + obj, err := fs.sc.GetObject(&s3.GetObjectInput{ + Bucket: &bucket, + Key: &fileName, + }) + if err != nil { + if awsErr, ok := err.(awserr.Error); ok { + if awsErr.Code() == "NoSuchKey" { + return nil, os.ErrNotExist + } + } + } + if err != nil { + return nil, err + } + return &statInfo{ + name: path.Base(fileName), + size: *obj.ContentLength, + }, nil +} + +func (fs *s3FS) MkdirAll(path string, perm os.FileMode) error { return nil } + +func (fs *s3FS) OpenFile(name string, flag int, perm os.FileMode) (wkfs.FileWriter, error) { + return nil, errors.New("not implemented") +} + +type statInfo struct { + name string + size int64 + isDir bool + modtime time.Time +} + +func (si *statInfo) IsDir() bool { return si.isDir } +func (si *statInfo) ModTime() time.Time { return si.modtime } +func (si *statInfo) Mode() os.FileMode { return 0644 } +func (si *statInfo) Name() string { return path.Base(si.name) } +func (si *statInfo) Size() int64 { return si.size } +func (si *statInfo) Sys() interface{} { return nil } + +type file struct { + name string + *bytes.Reader +} + +func (*file) Close() error { return nil } +func (f *file) Name() string { return path.Base(f.name) } +func (f *file) Stat() (os.FileInfo, error) { + panic("Stat not implemented on /s3/ files yet") +} diff --git a/server/wkfs/vaultfs/vault.go b/server/wkfs/vaultfs/vault.go new file mode 100644 index 0000000..6f11057 --- /dev/null +++ b/server/wkfs/vaultfs/vault.go @@ -0,0 +1,91 @@ +package vaultfs + +import ( + "bytes" + "errors" + "os" + "path" + "time" + + "github.com/nsheridan/cashier/server/config" + "github.com/nsheridan/cashier/server/helpers/vault" + "go4.org/wkfs" +) + +// Register the /vault/ filesystem as a well-known filesystem. +func Register(vc *config.Vault) { + client, err := vault.NewClient(vc.Address, vc.Token) + if err != nil { + registerBrokenFS(err) + return + } + wkfs.RegisterFS("/vault/", &vaultFS{ + client: client, + }) +} + +func registerBrokenFS(err error) { + wkfs.RegisterFS("/vault/", &vaultFS{ + err: err, + }) +} + +type vaultFS struct { + err error + client *vault.Client +} + +// Open opens the named file for reading. +func (fs *vaultFS) Open(name string) (wkfs.File, error) { + secret, err := fs.client.Read(name) + if err != nil { + return nil, err + } + return &file{ + name: name, + Reader: bytes.NewReader([]byte(secret)), + }, nil +} + +func (fs *vaultFS) Stat(name string) (os.FileInfo, error) { return fs.Lstat(name) } +func (fs *vaultFS) Lstat(name string) (os.FileInfo, error) { + secret, err := fs.client.Read(name) + if err != nil { + return nil, err + } + return &statInfo{ + name: path.Base(name), + size: int64(len(secret)), + }, nil +} + +func (fs *vaultFS) MkdirAll(path string, perm os.FileMode) error { return nil } + +func (fs *vaultFS) OpenFile(name string, flag int, perm os.FileMode) (wkfs.FileWriter, error) { + return nil, errors.New("not implemented") +} + +type statInfo struct { + name string + size int64 + isDir bool + modtime time.Time +} + +func (si *statInfo) IsDir() bool { return si.isDir } +func (si *statInfo) ModTime() time.Time { return si.modtime } +func (si *statInfo) Mode() os.FileMode { return 0644 } +func (si *statInfo) Name() string { return path.Base(si.name) } +func (si *statInfo) Size() int64 { return si.size } +func (si *statInfo) Sys() interface{} { return nil } + +type file struct { + name string + *bytes.Reader +} + +func (*file) Close() error { return nil } +func (f *file) Name() string { return path.Base(f.name) } +func (f *file) Stat() (os.FileInfo, error) { + return nil, errors.New("Stat not implemented on /vault/ files") +} -- cgit v1.2.3