keysync

type APIServer struct {
	// contains filtered or unexported fields
}

type BackupBundleClient struct {
	// contains filtered or unexported fields
}

type Client interface {
	Secret(name string) (secret *Secret, err error)
	SecretList() (map[string]Secret, error)
	SecretListWithContents(secrets []string) (map[string]Secret, error)
	Logger() *logrus.Entry
	RebuildClient() error
}

type ClientConfig struct {
	Key        string `yaml:"key"`       // Mandatory: Path to PEM key to use
	Cert       string `yaml:"cert"`      // Optional: PEM Certificate (If cert isn't in key file)
	User       string `yaml:"user"`      // Optional: User and Group are defaults for files without metadata
	DirName    string `yaml:"directory"` // Optional: What directory under SecretsDir this client is in. Defaults to the client name.
	Group      string `yaml:"group"`     // Optional: If unspecified, the global defaults are used.
	MaxRetries uint16
	Timeout    string
	MinBackoff string
	MaxBackoff string
}

type Config struct {
	ClientsDir    string            `yaml:"client_directory"`  // A directory of configuration files
	SecretsDir    string            `yaml:"secrets_directory"` // The directory secrets will be written to
	CaFile        string            `yaml:"ca_file"`           // The CA to trust (PEM) for Keywhiz communication
	YamlExt       string            `yaml:"yaml_ext"`          // The filename extension of the yaml config files
	PollInterval  string            `yaml:"poll_interval"`     // If specified, poll at the given interval, otherwise, exit after syncing
	ClientTimeout string            `yaml:"client_timeout"`    // If specified, timeout client connections after specified duration, otherwise use default.
	MinBackoff    string            `yaml:"min_backoff"`       // If specified, wait time before first retry, otherwise, use default.
	MaxBackoff    string            `yaml:"max_backoff"`       // If specified, max wait time before retries, otherwise, use default.
	MaxRetries    uint16            `yaml:"max_retries"`       // If specified, retry each HTTP call after non-200 response
	Server        string            `yaml:"server"`            // The server to connect to (host:port)
	Debug         bool              `yaml:"debug"`             // Enable debugging output
	DefaultUser   string            `yaml:"default_user"`      // Default user to own files
	DefaultGroup  string            `yaml:"default_group"`     // Default group to own files
	APIPort       uint16            `yaml:"api_port"`          // Port for API to listen on
	SentryDSN     string            `yaml:"sentry_dsn"`        // Sentry DSN
	SentryCaFile  string            `yaml:"sentry_ca_file"`    // The CA to trust (PEM) for Sentry communication
	FsType        output.Filesystem `yaml:"filesystem_type"`   // Enforce writing this type of filesystem. Use value from statfs.
	ChownFiles    bool              `yaml:"chown_files"`       // Do we chown files? Set to false when running without CAP_CHOWN.
	MetricsPrefix string            `yaml:"metrics_prefix"`    // Prefix metric names with this
	Monitor       MonitorConfig     `yaml:"monitor"`           // Config for monitoring/alerts
	BackupPath    string            `yaml:"backup_path"`       // If specified, back up secrets as an encrypted tarball to this location
	BackupKeyPath string            `yaml:"backup_key_path"`   // write wrapped key encrypting the backup to this location
	BackupPubkey  string            `yaml:"backup_pubkey"`     // Public key to wrap backup keys to, from keyunwrap --generate
}

type KeywhizHTTPClient struct {
	// contains filtered or unexported fields
}

type MonitorConfig struct {
	MinCertLifetime     time.Duration `yaml:"min_cert_lifetime"`     // If specified, warn if cert does not have given min lifetime.
	MinSecretsCount     int           `yaml:"min_secrets_count"`     // If specified, warn if client has less than minimum number of secrets
	AlertEmailServer    string        `yaml:"alert_email_server"`    // For alert emails: SMTP server host:port to use for sending email
	AlertEmailRecipient string        `yaml:"alert_email_recipient"` // For alert emails: Recipient of alert emails
	AlertEmailSender    string        `yaml:"alert_email_sender"`    // For alert emails: Sender (from) for alert emails
}

type Output interface {
	// Validate returns true if the secret is persisted already
	Validate(secret *Secret, state secretState) bool
	// Write a secret
	Write(secret *Secret) (*secretState, error)
	// Remove a secret
	Remove(name string) error
	// Remove all secrets and the containing directory (eg, when the client config is removed)
	// Returns a count of deleted files
	RemoveAll() (uint, error)
	// Cleanup unknown files (eg, ones deleted in Keywhiz while keysync was not running)
	// Returns a count of deleted files
	Cleanup(map[string]Secret) (uint, error)
}

type OutputCollection interface {
	NewOutput(clientConfig ClientConfig, logger *logrus.Entry) (Output, error)
	// Cleanup unknown clients (eg, ones deleted while keysync was not running)
	// Returns a count of deleted clients
	Cleanup(map[string]struct{}, *logrus.Entry) (uint, []error)
}

type OutputDir struct {
	WriteDirectory    string
	DefaultOwnership  ownership.Ownership
	EnforceFilesystem output.Filesystem // What filesystem type do we expect to write to?
	ChownFiles        bool              // Do we chown the file? (Needs root or CAP_CHOWN).
	Logger            *logrus.Entry
}

type OutputDirCollection struct {
	Config *Config
}

type Secret struct {
	Name             string
	Content          content   `json:"secret"`
	Length           uint64    `json:"secretLength"`
	Checksum         string    `json:"checksum"`
	CreatedAt        time.Time `json:"creationDate"`
	UpdatedAt        time.Time `json:"updateDate"`
	FilenameOverride *string   `json:"filename"`
	Mode             string
	Owner            string
	Group            string
}

type SecretDeleted struct{}

type StatusResponse struct {
	Ok      bool     `json:"ok"`
	Message string   `json:"message,omitempty"`
	Updated *Updated `json:"updated,omitempty"`
}

type Syncer struct {
	// contains filtered or unexported fields
}

type Updated struct {
	Added   uint
	Changed uint
	Deleted uint
}