jschoubben
fb039250f6
take-over waits on a hash for every user of the loaded list, and the vault holds no value for the controller's own account, the node accounts and the enrolled devices. The bus node's engine now hands every loaded user's hash in the bus module's have, sealed to the vault's key (mesh-host and mesh-sdk on the same branch). The vault answers its key in node-key, reads the haves (manifest reads node-engine.have, granted from the manifest, no controller change), watches the bus module's have, opens the handing with its own key, and writes each user it holds no value for into bus-accounts marked adopted, with the list and node it came from, saying account-hashed. It never touches a user whose covered account it holds or whose key is its own hash, writes an adopted key again only for another hash, and refuses a handing from any node the assignments do not name as holding the bus module. Tools: account_adopt adopts now from the have as the watch does; secret_own, unnarrowed by module, lists the adopted accounts and the last adoption.
185 lines
3.7 KiB
JSON
185 lines
3.7 KiB
JSON
{
|
|
"module": "mesh-vault",
|
|
"version": "1",
|
|
"runs-as": "mesh-vault",
|
|
"provides": [
|
|
{
|
|
"name": "secret",
|
|
"scope": "mesh",
|
|
"identity": {
|
|
"in": "a vault entry"
|
|
}
|
|
}
|
|
],
|
|
"emits": [
|
|
"provisioned",
|
|
"rotated",
|
|
"secret-changed",
|
|
"account-hashed"
|
|
],
|
|
"reads": [
|
|
"mesh-controller.assignments",
|
|
"node-engine.have"
|
|
],
|
|
"state": [
|
|
{
|
|
"name": "bus-accounts",
|
|
"history": 2
|
|
}
|
|
],
|
|
"receives": {
|
|
"secret": "${dir:grants}/mesh.json"
|
|
},
|
|
"grants": {
|
|
"secret": "${dir:grants}"
|
|
},
|
|
"keeps": "/var/lib/mesh-vault/root",
|
|
"data": {
|
|
"own": [
|
|
{
|
|
"id": "state",
|
|
"path": "${dir:state}",
|
|
"class": "valuable",
|
|
"why": "the vault's own keys"
|
|
},
|
|
{
|
|
"id": "ledger",
|
|
"path": "${dir:ledger}",
|
|
"class": "valuable",
|
|
"why": "every secret the vault keeps"
|
|
},
|
|
{
|
|
"id": "root",
|
|
"path": "${dir:root}",
|
|
"class": "valuable",
|
|
"why": "the vault's root material"
|
|
},
|
|
{
|
|
"id": "store",
|
|
"path": "${dir:store}",
|
|
"class": "valuable",
|
|
"why": "every secret the vault holds, sealed to its own key and to the operator key"
|
|
}
|
|
],
|
|
"consumers": {
|
|
"secret": {
|
|
"class": "valuable",
|
|
"in": "ledger",
|
|
"why": "a secret given to a consumer is kept nowhere else in the clear"
|
|
}
|
|
}
|
|
},
|
|
"own-secrets": {
|
|
"broker": "${dir:state}/broker"
|
|
},
|
|
"secrets-owner": "mesh-vault",
|
|
"runtime-health": {
|
|
"kind": "tool",
|
|
"tool": "vault_health",
|
|
"interval": "60s",
|
|
"timeout": "10s",
|
|
"looks": 2,
|
|
"grace": "60s"
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "account",
|
|
"type": "user",
|
|
"name": "mesh-vault",
|
|
"shell": "/usr/bin/nologin",
|
|
"home": "/var/lib/mesh-vault"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "mesh-vault",
|
|
"place": ".",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "grants",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "mesh-vault",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "ledger",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "mesh-vault",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "root",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "mesh-vault",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "store",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "mesh-vault",
|
|
"unknown": "program"
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "code",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/mesh-vault",
|
|
"binary": "mesh-vault",
|
|
"loads": [
|
|
"mesh-vault"
|
|
],
|
|
"env": {
|
|
"MESH_RECEIVES": "${dir:grants}/mesh.json",
|
|
"MESH_VAULT_LEDGER": "${dir:ledger}",
|
|
"MESH_VAULT_ROOT": "${dir:root}",
|
|
"MESH_VAULT_STORE": "${dir:store}",
|
|
"MESH_VAULT_STATE": "${dir:state}"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"tools": [
|
|
"secret_export",
|
|
"secret_holders",
|
|
"secret_verify",
|
|
"secret_handed",
|
|
"secret_own",
|
|
"account_hash",
|
|
"account_adopt",
|
|
"secret_asks",
|
|
"secret_vault_export",
|
|
"provisioner_retirement",
|
|
"provisioner_retire_approve",
|
|
"provisioner_retire_reject",
|
|
"provisioner_delete",
|
|
"vault_status",
|
|
"vault_health"
|
|
],
|
|
"claims": [
|
|
{
|
|
"name": "mesh-vault",
|
|
"scope": "mesh",
|
|
"serves": [
|
|
"get",
|
|
"accept",
|
|
"secret-ask",
|
|
"issued",
|
|
"rotate",
|
|
"move-in",
|
|
"node-key",
|
|
"move-asks"
|
|
]
|
|
}
|
|
]
|
|
}
|