tism

====================================
tISM - the Immutable Secrets Manager
====================================

.. image:: https://goreportcard.com/badge/github.com/deuscapturus/tism
   :alt: Go Report Card
   :target: https://goreportcard.com/report/github.com/deuscapturus/tism

.. image:: https://godoc.org/github.com/deuscapturus/tism?status.png
   :alt: GoDoc
   :target: https://godoc.org/github.com/deuscapturus/tism

tISM is PGP encryption-as-a-service for secrets management.  Decrypt/Encrypt PGP secrets via API with token authorization.

tISM solves the immutable infrastructure problem of secrets management.

.. contents::
    :local:
    
.. WARNING::

   Use at your own risk!

Features
========

* Does not store any secrets.
* Simple. No databases. The only persistent data is a pgp keyring and configuration file.
* Asymmetric encryption with secure and ubiquitous PGP/GPG.  Allows secrets to be encrypted with distributed public keys.
* Authorization with short lived and revocable JWT tokens.

Security
========

tISM relies on 3 separated components to access secrets.

1.  Access Token.
2.  PGP Encrypted Message
3.  tISM Server

Access Tokens are implemented with JSON Web Token https://tools.ietf.org/html/rfc7519
Message Encryption and Decryption is implemented with OpenPGP https://tools.ietf.org/html/rfc4880

Quick Start
===========

RPM
---

.. code::

  #Install
  sudo dnf install https://github.com/deuscapturus/tism/releases/download/0.0/tism-0.0-1.fc25.x86_64.rpm
  
  #Initialize
  sudo tism -t -c -n
  
  #Run
  sudo systemctl start tism

machinectl
----------

Run as a container with systemd-nspawn.  systemd-nspawn runs containers and ships with systemd.  So it is available on most Linux distributions without any further setup.

.. code::

  #Install
  sudo machinectl --verify=checksum pull-tar https://github.com/deuscapturus/tism/releases/download/0.0/tism-0.0.tgz
  
  #Initialize
  sudo systemd-nspawn -M tism-0.0 tism -t -c -n
  
  #Run
  sudo systemd-nspawn -M tism-0.0 tism


docker
------

Docker is annoyingly opinionated about forcing immutable containers.  As a result we have one additional step here.

.. code::

  #Install
  docker import -c 'EXPOSE 8080' https://github.com/deuscapturus/tism/releases/download/0.0/tism-0.0.tgz tism

  #Initialize
  docker run --name=tism tism tism -t -c -n

  #Generate new image from initialized container
  docker commit tism tism:initialized

  #Run
  docker run -d tism:initialized tism
  

Web UI  
======

To use the web ui your browser must have es6 module support enabled (a very new feature).

Currently Supported Browers:

- Firefox 54 or greater with `dom.moduleScripts.enabled`
- Safari 10.1 or greater

https://localhost:8080

.. image:: tism-web-ui.png

API
===

`API Documentation <API.rst>`_