119 lines
3.9 KiB
Go
119 lines
3.9 KiB
Go
// mesh-vault (novox/hq ADR 0085, ADR 0113, ADR 0349 §7 and §11): one binary, launched by its node's runtime
|
|
// and speaking MCP to it over stdio through the Go SDK. It holds the `mesh-vault` seat: it keeps every
|
|
// secret in its own store, sealed at rest and with a copy sealed to the operator key; it answers the seat's
|
|
// verb `get` with a secret sealed to the asker's key; it raises `secret-changed` without a value. Beside
|
|
// that it keeps the custody ledger of the pair credentials the controller still delivers to it.
|
|
//
|
|
// stdout is the MCP channel; everything this module says, it says on stderr.
|
|
package main
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"time"
|
|
|
|
stdio "git.novox.be/novox/mesh-sdk/go"
|
|
)
|
|
|
|
func say(format string, args ...any) {
|
|
fmt.Fprintf(os.Stderr, "[mesh-vault] "+format+"\n", args...)
|
|
}
|
|
|
|
func emit(event string, body map[string]any) error { return stdio.Emit(event, body) }
|
|
|
|
// build makes the vault from the module's words: directories, never values.
|
|
func build() *Env {
|
|
env := &Env{Receives: os.Getenv("MESH_RECEIVES"), Root: os.Getenv("MESH_VAULT_ROOT")}
|
|
if l, err := NewLedger(os.Getenv("MESH_VAULT_LEDGER")); err == nil {
|
|
env.Ledger = l
|
|
} else {
|
|
say("%v", err)
|
|
}
|
|
if env.Ledger != nil && env.Receives != "" {
|
|
env.Custody = &Custody{Ledger: env.Ledger, Receives: env.Receives, Resource: "secret", Node: os.Getenv("MESH_NODE"),
|
|
Emit: emit, Now: time.Now, Log: say}
|
|
}
|
|
store, err := OpenStore(os.Getenv("MESH_VAULT_STORE"))
|
|
if err != nil {
|
|
env.Broken = fmt.Errorf("the vault could not open its store: %w", err)
|
|
say("%v", env.Broken)
|
|
return env
|
|
}
|
|
own, err := OwnKey(os.Getenv("MESH_VAULT_STATE"), store)
|
|
if err != nil {
|
|
env.Broken = fmt.Errorf("the vault could not open its key: %w", err)
|
|
say("%v", env.Broken)
|
|
return env
|
|
}
|
|
// Who may ask (askers.go): a node's provisioner client, for what its module's plan there names.
|
|
// Where it sees a consumer bind a provider (pair.go): the same mirror, every key.
|
|
env.Vault = &Vault{Store: store, Own: own, Askers: Declared{Read: readAssignment, Store: store},
|
|
Assignments: Mirror{Keys: assignmentKeys, Read: readAssignment}, Emit: emit, Ask: stdio.Ask,
|
|
Now: time.Now, Log: say}
|
|
return env
|
|
}
|
|
|
|
// adoptOperatorKey takes the operator key from the export the mesh writes to the vault's root (what
|
|
// `operator key set` recorded; the controller keeps only a public half there), and seals again any
|
|
// operator copy not yet sealed to the current key. Run every minute, so a failure partway is finished. It
|
|
// returns why the pass did not re-seal everything, or nil.
|
|
func adoptOperatorKey(env *Env) error {
|
|
if env.Vault == nil {
|
|
if env.Broken != nil {
|
|
return env.Broken
|
|
}
|
|
return errors.New("the vault was not built")
|
|
}
|
|
if raw := exportedOperatorKey(env.Root); env.Root != "" && raw != "" {
|
|
key, err := publicPEM(raw)
|
|
if err == nil {
|
|
_, err = env.Vault.SetOperatorKey(key, "the mesh's export")
|
|
}
|
|
env.refuseKey("")
|
|
if err != nil {
|
|
env.refuseKey(err.Error())
|
|
say("the operator key in the mesh's export is not taken, or not every copy is sealed to it yet: %v", err)
|
|
}
|
|
return err
|
|
}
|
|
_, err := env.Vault.Reseal()
|
|
if err != nil {
|
|
say("%v", err)
|
|
}
|
|
return err
|
|
}
|
|
|
|
// readAssignment is one value of the controller's assignments mirror, read through the runtime under the vault's
|
|
// own account (its manifest `reads` it), or nil when there is none.
|
|
func readAssignment(key string) ([]byte, error) {
|
|
e, err := stdio.State(AssignmentsRead).Get(key)
|
|
if err != nil || e == nil {
|
|
return nil, err
|
|
}
|
|
return e.Value, nil
|
|
}
|
|
|
|
// assignmentKeys is every key of the controller's assignments mirror, read the same way.
|
|
func assignmentKeys() ([]string, error) { return stdio.State(AssignmentsRead).Keys() }
|
|
|
|
func main() {
|
|
env := build()
|
|
go func() {
|
|
tick := time.NewTicker(time.Minute)
|
|
defer tick.Stop()
|
|
for {
|
|
env.pass()
|
|
env.pairPass()
|
|
if env.Custody != nil {
|
|
env.Custody.Pass()
|
|
}
|
|
<-tick.C
|
|
}
|
|
}()
|
|
if err := stdio.Serve("", tools(env)); err != nil {
|
|
say("%v", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|