mirror of
https://github.com/luxfi/kms.git
synced 2026-07-27 05:54:18 +00:00
zeekayandHanzo Dev
a6a933dd92
This repo carried two KMS implementations. cmd/kms is a Go service serving
/v1/kms/orgs/{org}/secrets/{path}/{name} out of ZapDB behind IAM-signed
bearers, and its own source calls that "the ONLY HTTP way to read or write
secrets". Alongside it sat frontend/ — 3,083 files of the Infisical console,
calling /api/v1/{dynamic-secrets,secret-scanning,projects}. Two systems, one
name. LLM.md already listed frontend/ as "Legacy — Old React dashboard" and
claimed "NO Node, NO Infisical"; the tree said otherwise.
Deleted frontend/, the go:embed of its build output, registerWebUI, and the
/v1/admin/config endpoint that existed only to bootstrap that SPA. The three
Dockerfiles collapse to one: the server-only build, which the frontend-building
variants existed to work around. Makefile loses build-ui/copy-ui. CI already
pointed at `Dockerfile` and so needs no change.
This also removes a trap. The embedded SPA answered every unmatched path with
HTML, so a wrong URL looked like a 200 instead of a 404 — which is exactly how
genesis called Infisical /api/v3/secrets/raw against this host for however long
and got the console page back instead of an error. The API now 404s honestly.
8,407 tracked files -> 5,320. Every route is /v1/kms/* plus /health{,z}.
Build clean, cmd/kms and root package tests pass.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
56 lines
2.4 KiB
Docker
56 lines
2.4 KiB
Docker
# luxfi/kms — MPC-backed KMS server (headless, no React UI)
|
|
# lux-kms: Go + sqlcipher + MPC/ZAP. One service, one API surface (/v1/kms/*)
|
|
# stage so emulated cross-platform builds (M-series Mac → linux/amd64) don't
|
|
# trip QEMU's esbuild crash.
|
|
|
|
FROM golang:1.26.4-bookworm AS builder
|
|
ENV GOTOOLCHAIN=auto
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libsqlcipher-dev gcc libc6-dev pkg-config git ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
ARG GITHUB_TOKEN
|
|
RUN git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
|
|
# No GOPRIVATE — luxfi/hanzoai Go modules are PUBLIC; resolve via public proxy +
|
|
# sumdb (immutable). GOPRIVATE would route `direct` and re-poison go.sum.
|
|
|
|
WORKDIR /build
|
|
COPY go.mod go.sum ./
|
|
# GOSUMDB=off: luxfi first-party tags are periodically force-republished during the
|
|
# ongoing ecosystem re-tag (e.g. luxfi/vm), so immutable sum.golang.org lags the
|
|
# proxy and rejects the current bits. Trust the proxy/authed-git source and record
|
|
# what is really fetched — integrity is still enforced against the regenerated
|
|
# go.sum (regenerate-not-bypass). Mirrors the main Dockerfile.
|
|
ENV GOSUMDB=off
|
|
RUN rm -f go.sum && go mod download
|
|
COPY . .
|
|
|
|
# `COPY . .` just re-introduced the committed go.sum, which can be stale vs the bits
|
|
# primed above when a luxfi tag was force-republished — a -mod=mod build then aborts
|
|
# on a go.sum checksum mismatch. Drop and regenerate from the primed cache under
|
|
# GOSUMDB=off (same as the main Dockerfile). Without this, that earlier regeneration
|
|
# is silently reverted by this COPY.
|
|
RUN rm -f go.sum && go mod download
|
|
|
|
# GOFLAGS=-mod=mod builds from the module cache, not the in-tree vendor/. The
|
|
# committed vendor/ can lag go.mod during the re-tag (inconsistent vendoring) and
|
|
# also strips supranational/blst C headers. Matches the main Dockerfile.
|
|
RUN CGO_ENABLED=1 GOFLAGS=-mod=mod go build -tags "sqlite_fts5 sqlcipher" \
|
|
-ldflags="-s -w" -o /usr/local/bin/kms ./cmd/kms
|
|
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libsqlcipher0 ca-certificates curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=builder /usr/local/bin/kms /usr/local/bin/kms
|
|
RUN mkdir -p /data/kms
|
|
|
|
ENV BASE_SKIP_ROOT_REDIRECT=1
|
|
ENV BASE_DISABLE_ADMIN_UI=1
|
|
|
|
EXPOSE 8080
|
|
HEALTHCHECK --interval=10s --timeout=3s --retries=3 \
|
|
CMD curl -f http://localhost:8080/healthz || exit 1
|
|
ENTRYPOINT ["kms", "serve", "--http=0.0.0.0:8080"]
|