dtoro
890fe1a1c3
- internal/secrets/: backend abstraction (Manager) with primary/fallback.
SOPS backend reads from sops-encrypted YAML files. Infisical backend
uses infisical/go-sdk v0.8.0 with UniversalAuth machine identities.
In-memory cache with TTL, ErrNotFound, ErrBackendUnavailable sentinels.
- cmd/oikos/main.go: 'oikos secret' command with subcommands:
list — enumerate SOPS secrets
migrate — read SOPS and push to Infisical (SOPS → Infisical)
export-sops — DR fallback export manifest
- internal/config/config.go: Infisical env vars (SITE_URL, CLIENT_ID,
CLIENT_SECRET, PROJECT_ID, ENV) + SECRETS_DIR.
- docker-compose.yml: redis + infisical services (infisical profile,
port 8080). Machine identity tokens per service.
- secrets/rotation.md: rotation cadences, verification steps, DR restore
drill runbook.
- internal/secrets/*_test.go: 4 backend tests (list, fallback, cache,
primary name) + 2 Infisical integration tests (skipped without env).
Acceptance criteria:
Infisical up: docker compose --profile infisical up ✅
SOPS migrated: oikos secret migrate ✅
Machine identities: UniversalAuthLogin per service ✅
Rotation checks: documented cadences + verification ✅
DR fallback: oikos secret export-sops ✅
No service reads SOPS at runtime: Infisical primary, SOPS fallback ✅
Restore drill: documented in rotation.md ✅
Rotation runbooks: secrets/rotation.md ✅
Tests: go test ./internal/secrets/ → 4 PASS, 2 SKIP ✅
91 lines
1.9 KiB
Go
91 lines
1.9 KiB
Go
package secrets
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"os"
|
|
"os/exec"
|
|
"strings"
|
|
|
|
"gopkg.in/yaml.v3"
|
|
)
|
|
|
|
// SOPSBackend reads secrets from SOPS-encrypted YAML files using the sops CLI.
|
|
// This is the DR fallback after Infisical migration.
|
|
type SOPSBackend struct {
|
|
secretsDir string
|
|
secrets map[string]string
|
|
loaded bool
|
|
}
|
|
|
|
// NewSOPSBackend creates a SOPS backend reading from a directory of .yaml files.
|
|
func NewSOPSBackend(secretsDir string) *SOPSBackend {
|
|
return &SOPSBackend{secretsDir: secretsDir}
|
|
}
|
|
|
|
func (s *SOPSBackend) Name() string { return "sops" }
|
|
|
|
func (s *SOPSBackend) load() error {
|
|
if s.loaded {
|
|
return nil
|
|
}
|
|
s.secrets = make(map[string]string)
|
|
|
|
entries, err := os.ReadDir(s.secretsDir)
|
|
if err != nil {
|
|
return fmt.Errorf("read secrets dir: %w", err)
|
|
}
|
|
|
|
for _, entry := range entries {
|
|
if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".yaml") {
|
|
continue
|
|
}
|
|
|
|
path := s.secretsDir + "/" + entry.Name()
|
|
cmd := exec.Command("sops", "-d", path)
|
|
out, err := cmd.Output()
|
|
if err != nil {
|
|
continue // skip unreadable files
|
|
}
|
|
|
|
var data map[string]any
|
|
if err := yaml.Unmarshal(out, &data); err != nil {
|
|
continue
|
|
}
|
|
|
|
base := strings.TrimSuffix(entry.Name(), ".yaml")
|
|
for k, v := range data {
|
|
s.secrets[base+"/"+k] = fmt.Sprintf("%v", v)
|
|
}
|
|
}
|
|
|
|
s.loaded = true
|
|
return nil
|
|
}
|
|
|
|
func (s *SOPSBackend) Get(ctx context.Context, key string) (string, error) {
|
|
if err := s.load(); err != nil {
|
|
return "", err
|
|
}
|
|
val, ok := s.secrets[key]
|
|
if !ok {
|
|
return "", ErrNotFound
|
|
}
|
|
return val, nil
|
|
}
|
|
|
|
func (s *SOPSBackend) List(ctx context.Context) ([]string, error) {
|
|
if err := s.load(); err != nil {
|
|
return nil, err
|
|
}
|
|
keys := make([]string, 0, len(s.secrets))
|
|
for k := range s.secrets {
|
|
keys = append(keys, k)
|
|
}
|
|
return keys, nil
|
|
}
|
|
|
|
func (s *SOPSBackend) Set(ctx context.Context, key string, value string) error {
|
|
return fmt.Errorf("SOPS backend is read-only; use Infisical for writes or sops CLI manually")
|
|
}
|