0.27.0 — Infisical hardening: runtime refresh, audit logging, CLI verify/audit, startup verification, SSH host key verification, interface consolidation

cmd/oikos/main.go

@@ -37,12 +37,39 @@ func main() {
 	logger := observability.NewLogger(cfg.Debug)
 	slog.SetDefault(logger)
 
-	slog.Info("starting oikos", "role", role, "config", cfg)
-
 	ctx, cancel := signal.NotifyContext(context.Background(),
 		syscall.SIGTERM, syscall.SIGINT)
 	defer cancel()
 
+	// Resolve secrets from Infisical, overlaying env-derived config values.
+	// If Infisical is not configured, env vars are used as-is (no change).
+	sec := secrets.NewManagerFromConfig(
+		cfg.InfisicalSiteURL,
+		cfg.InfisicalClientID,
+		cfg.InfisicalClientSecret,
+		cfg.InfisicalProjectID,
+		cfg.InfisicalEnv,
+		cfg.SecretsDir,
+	)
+	if sec != nil {
+		overlays := secrets.ConfigOverlays(map[string]func(string){
+			"matrix/token":         func(v string) { cfg.MatrixToken = v },
+			"approval/hmac-secret": func(v string) { cfg.ApprovalHMACSecret = v },
+			"mcp/bearer-token":     func(v string) { cfg.MCPBearerToken = v },
+			"api/token":            func(v string) { cfg.APIToken = v },
+			"oidc/client-secret":   func(v string) { cfg.OIDCClientSecret = v },
+		})
+		n := secrets.OverlayConfig(ctx, sec, overlays)
+		slog.Info("secrets resolved from Infisical", "count", n)
+
+		secrets.VerifyExpectedSecrets(ctx, sec, []string{
+			"matrix/token", "approval/hmac-secret", "mcp/bearer-token",
+			"api/token", "oidc/client-secret", "openrouter/api-key", "webhook/hmac-secret",
+		})
+	}
+
+	slog.Info("starting oikos", "role", role, "config", cfg)
+
 	switch role {
 	case "migrate":
 		if err := runMigrate(ctx, cfg); err != nil {
@@ -115,7 +142,7 @@ Roles:
   scheduler  Run the observe loop
   notifier   Run the notification service (Matrix alerts)
   all        Run all roles in one process (dev mode)
-  secret     Secret management (Infisical: get, set, list, migrate, export-sops)
+  secret     Secret management (Infisical: get, set, list, verify, audit, migrate, export-sops)
   knowledge  Convert wiki to knowledge seed (one-shot)
   version    Print version info
 
@@ -336,6 +363,12 @@ func runSecret(ctx context.Context, cfg config.Config) {
 			fmt.Println(k)
 		}
 
+	case "verify":
+		runSecretVerify(ctx, cfg)
+
+	case "audit":
+		runSecretAudit(ctx, cfg)
+
 	case "migrate", "export-sops":
 		runSecretLegacy(ctx, cfg, sub)
 
@@ -345,6 +378,93 @@ func runSecret(ctx context.Context, cfg config.Config) {
 	}
 }
 
+// expectedSecrets is the set of keys that should exist in Infisical
+// for a fully-migrated deployment.
+var expectedSecrets = []string{
+	"matrix/token",
+	"approval/hmac-secret",
+	"mcp/bearer-token",
+	"api/token",
+	"oidc/client-secret",
+	"openrouter/api-key",
+	"webhook/hmac-secret",
+}
+
+// runSecretVerify checks that all expected secrets are present in Infisical.
+func runSecretVerify(ctx context.Context, cfg config.Config) {
+	backend := newInfisicalBackendOrFail(cfg)
+	keys, err := backend.List(ctx)
+	if err != nil {
+		slog.Error("verify: list", "error", err)
+		os.Exit(1)
+	}
+	keySet := make(map[string]struct{}, len(keys))
+	for _, k := range keys {
+		keySet[k] = struct{}{}
+	}
+
+	missing := 0
+	for _, exp := range expectedSecrets {
+		if _, ok := keySet[exp]; !ok {
+			fmt.Printf("MISSING: %s\n", exp)
+			missing++
+		} else {
+			fmt.Printf("OK:      %s\n", exp)
+		}
+	}
+
+	fmt.Printf("\n%d/%d present, %d missing\n", len(expectedSecrets)-missing, len(expectedSecrets), missing)
+	if missing > 0 {
+		os.Exit(1)
+	}
+}
+
+// runSecretAudit resolves all expected secrets from Infisical and prints
+// a diff against current env-derived values. Values are truncated for safety.
+func runSecretAudit(ctx context.Context, cfg config.Config) {
+	backend := newInfisicalBackendOrFail(cfg)
+
+	envValues := map[string]string{
+		"matrix/token":         cfg.MatrixToken,
+		"approval/hmac-secret": cfg.ApprovalHMACSecret,
+		"mcp/bearer-token":     cfg.MCPBearerToken,
+		"api/token":            cfg.APIToken,
+		"oidc/client-secret":   cfg.OIDCClientSecret,
+	}
+
+	fmt.Println("key                           infisical  env        status")
+	fmt.Println(strings.Repeat("-", 72))
+
+	for _, key := range expectedSecrets {
+		infVal, infErr := backend.Get(ctx, key)
+		envVal := envValues[key]
+
+		if infErr != nil {
+			fmt.Printf("%-29s ERROR      %-10s NOT-IN-INFISICAL\n", key, trunc(envVal, 8))
+			continue
+		}
+		if envVal == "" {
+			fmt.Printf("%-29s %-10s (empty)   INFISICAL-ONLY\n", key, trunc(infVal, 8))
+			continue
+		}
+		if infVal == envVal {
+			fmt.Printf("%-29s %-10s %-10s MATCH\n", key, trunc(infVal, 8), trunc(envVal, 8))
+		} else {
+			fmt.Printf("%-29s %-10s %-10s DRIFT\n", key, trunc(infVal, 8), trunc(envVal, 8))
+		}
+	}
+}
+
+func trunc(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	if n > 1 {
+		return s[:n-1] + "…"
+	}
+	return s[:n]
+}
+
 // newInfisicalBackendOrFail creates an Infisical backend from config or exits.
 func newInfisicalBackendOrFail(cfg config.Config) *secrets.InfisicalBackend {
 	if cfg.InfisicalSiteURL == "" {