From a3554d3551b7e07185e1ce09107cf26d3b399be8 Mon Sep 17 00:00:00 2001 From: David Blattmann Date: Fri, 15 Dec 2023 10:27:06 +0100 Subject: [PATCH 1/8] renamed SecretExpiry to MaxSecretExpiry --- History.md | 2 +- README.md | 2 +- api.go | 4 ++-- docker-compose.yml | 2 +- docs/k8s_example.yml | 2 +- main.go | 18 +++++++++--------- 6 files changed, 15 insertions(+), 15 deletions(-) diff --git a/History.md b/History.md index 46b9956..f41a95f 100644 --- a/History.md +++ b/History.md @@ -143,7 +143,7 @@ * Only mention tool name in footer (#71) * Replace redis client, move expiry into creation interface -With this release an old migration was removed and in case you are still using the `REDIS_EXPIRY` environment variable you need to switch to `SECRET_EXPIRY`. Also with the new redis client you might need to adjust the username in your `REDIS_URL` to a proper ACL username (or enable legacy auth in Redis) - see the README for the `REDIS_URL` format. +With this release an old migration was removed and in case you are still using the `REDIS_EXPIRY` environment variable you need to switch to `MAX_SECRET_EXPIRY`. Also with the new redis client you might need to adjust the username in your `REDIS_URL` to a proper ACL username (or enable legacy auth in Redis) - see the README for the `REDIS_URL` format. # 1.0.0 / 2023-04-14 diff --git a/README.md b/README.md index 1db58f8..212b68b 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,7 @@ For a better setup you can choose the backend which is used to store the secrets (pre Redis v6 use `auth` as user, afterwards use a user available in your ACLs) - `REDIS_KEY` - Key prefix to store the keys under (Default `io.luzifer.ots`) - Common options - - `SECRET_EXPIRY` - Expiry of the keys in seconds (Default `0` = no expiry) + - `MAX_SECRET_EXPIRY` - Expiry of the keys in seconds (Default `0` = no expiry) ### Customization diff --git a/api.go b/api.go index 82de183..3acd5cb 100644 --- a/api.go +++ b/api.go @@ -63,12 +63,12 @@ func (a apiServer) handleCreate(res http.ResponseWriter, r *http.Request) { } var ( - expiry = cfg.SecretExpiry + expiry = cfg.MaxSecretExpiry secret string ) if !cust.DisableExpiryOverride { - if ev, err := strconv.ParseInt(r.URL.Query().Get("expire"), 10, 64); err == nil && (ev < expiry || cfg.SecretExpiry == 0) { + if ev, err := strconv.ParseInt(r.URL.Query().Get("expire"), 10, 64); err == nil && (ev < expiry || cfg.MaxSecretExpiry == 0) { expiry = ev } } diff --git a/docker-compose.yml b/docker-compose.yml index 048dca3..87e4140 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -10,7 +10,7 @@ services: # See README for details REDIS_URL: redis://redis:6379/0 # 168h = 1w - SECRET_EXPIRY: "604800" + MAX_SECRET_EXPIRY: "604800" # "mem" or "redis" (See README) STORAGE_TYPE: redis depends_on: diff --git a/docs/k8s_example.yml b/docs/k8s_example.yml index 78905ad..e221c31 100644 --- a/docs/k8s_example.yml +++ b/docs/k8s_example.yml @@ -118,7 +118,7 @@ spec: value: tcp://ots-redis:6379 - name: REDIS_KEY value: ots - - name: SECRET_EXPIRY + - name: MAX_SECRET_EXPIRY value: "172800" volumeMounts: - mountPath: /custom diff --git a/main.go b/main.go index 404d34d..707a4ab 100644 --- a/main.go +++ b/main.go @@ -27,12 +27,12 @@ const scriptNonceSize = 32 var ( cfg struct { - Customize string `flag:"customize" default:"" description:"Customize-File to load"` - Listen string `flag:"listen" default:":3000" description:"IP/Port to listen on"` - LogLevel string `flag:"log-level" default:"info" description:"Set log level (debug, info, warning, error)"` - SecretExpiry int64 `flag:"secret-expiry" default:"0" description:"Maximum expiry of the stored secrets in seconds"` - StorageType string `flag:"storage-type" default:"mem" description:"Storage to use for putting secrets to" validate:"nonzero"` - VersionAndExit bool `flag:"version" default:"false" description:"Print version information and exit"` + Customize string `flag:"customize" default:"" description:"Customize-File to load"` + Listen string `flag:"listen" default:":3000" description:"IP/Port to listen on"` + LogLevel string `flag:"log-level" default:"info" description:"Set log level (debug, info, warning, error)"` + MaxSecretExpiry int64 `flag:"max-secret-expiry" default:"0" description:"Maximum expiry of the stored secrets in seconds"` + StorageType string `flag:"storage-type" default:"mem" description:"Storage to use for putting secrets to" validate:"nonzero"` + VersionAndExit bool `flag:"version" default:"false" description:"Print version information and exit"` } assets file_helpers.FSStack @@ -154,8 +154,8 @@ func main() { // Start server logrus.WithFields(logrus.Fields{ - "secret_expiry": time.Duration(cfg.SecretExpiry) * time.Second, - "version": version, + "max_secret_expiry": time.Duration(cfg.MaxSecretExpiry) * time.Second, + "version": version, }).Info("ots started") if err = server.ListenAndServe(); err != nil { @@ -216,7 +216,7 @@ func handleIndex(w http.ResponseWriter, _ *http.Request) { }{ Customize: cust, InlineContentNonce: inlineContentNonceStr, - MaxSecretExpiry: cfg.SecretExpiry, + MaxSecretExpiry: cfg.MaxSecretExpiry, Version: version, }); err != nil { http.Error(w, errors.Wrap(err, "executing template").Error(), http.StatusInternalServerError) From 4042cd065f855003fd7fd6e8f51f33551a92954c Mon Sep 17 00:00:00 2001 From: David Blattmann Date: Fri, 15 Dec 2023 11:55:09 +0100 Subject: [PATCH 2/8] add cfg option DefaultSecretExpire --- api.go | 7 +++++-- frontend/index.html | 2 ++ main.go | 36 ++++++++++++++++++++---------------- src/components/create.vue | 4 +++- 4 files changed, 30 insertions(+), 19 deletions(-) diff --git a/api.go b/api.go index 3acd5cb..b3a22ed 100644 --- a/api.go +++ b/api.go @@ -63,12 +63,15 @@ func (a apiServer) handleCreate(res http.ResponseWriter, r *http.Request) { } var ( - expiry = cfg.MaxSecretExpiry + expiry = cfg.DefaultSecretExpiry secret string ) if !cust.DisableExpiryOverride { - if ev, err := strconv.ParseInt(r.URL.Query().Get("expire"), 10, 64); err == nil && (ev < expiry || cfg.MaxSecretExpiry == 0) { + if cfg.DefaultSecretExpiry == 0 && cfg.MaxSecretExpiry > 0 { + cfg.DefaultSecretExpiry = cfg.MaxSecretExpiry + } + if ev, err := strconv.ParseInt(r.URL.Query().Get("expire"), 10, 64); err == nil && (ev <= cfg.MaxSecretExpiry || cfg.MaxSecretExpiry == 0) { expiry = ev } } diff --git a/frontend/index.html b/frontend/index.html index 8e9e77a..3ded167 100644 --- a/frontend/index.html +++ b/frontend/index.html @@ -47,6 +47,8 @@ // Template variable from Golang process const maxSecretExpire = {{ .MaxSecretExpiry }} + const defaultSecretExpire = {{ .DefaultSecretExpiry }} + const version = "{{ .Version }}" window.OTSCustomize = JSON.parse('{{ .Customize.ToJSON }}') window.useFormalLanguage = {{ .Customize.UseFormalLanguage | mustToJson }} diff --git a/main.go b/main.go index 707a4ab..e92634b 100644 --- a/main.go +++ b/main.go @@ -27,12 +27,13 @@ const scriptNonceSize = 32 var ( cfg struct { - Customize string `flag:"customize" default:"" description:"Customize-File to load"` - Listen string `flag:"listen" default:":3000" description:"IP/Port to listen on"` - LogLevel string `flag:"log-level" default:"info" description:"Set log level (debug, info, warning, error)"` - MaxSecretExpiry int64 `flag:"max-secret-expiry" default:"0" description:"Maximum expiry of the stored secrets in seconds"` - StorageType string `flag:"storage-type" default:"mem" description:"Storage to use for putting secrets to" validate:"nonzero"` - VersionAndExit bool `flag:"version" default:"false" description:"Print version information and exit"` + Customize string `flag:"customize" default:"" description:"Customize-File to load"` + Listen string `flag:"listen" default:":3000" description:"IP/Port to listen on"` + LogLevel string `flag:"log-level" default:"info" description:"Set log level (debug, info, warning, error)"` + MaxSecretExpiry int64 `flag:"max-secret-expiry" default:"0" description:"Maximum expiry of the stored secrets in seconds"` + DefaultSecretExpiry int64 `flag:"default-secret-expiry" default:"0" description:"Default expiry of the stored secrets in seconds"` + StorageType string `flag:"storage-type" default:"mem" description:"Storage to use for putting secrets to" validate:"nonzero"` + VersionAndExit bool `flag:"version" default:"false" description:"Print version information and exit"` } assets file_helpers.FSStack @@ -154,8 +155,9 @@ func main() { // Start server logrus.WithFields(logrus.Fields{ - "max_secret_expiry": time.Duration(cfg.MaxSecretExpiry) * time.Second, - "version": version, + "max_secret_expiry": time.Duration(cfg.MaxSecretExpiry) * time.Second, + "default_secret_expiry": time.Duration(cfg.DefaultSecretExpiry) * time.Second, + "version": version, }).Info("ots started") if err = server.ListenAndServe(); err != nil { @@ -209,15 +211,17 @@ func handleIndex(w http.ResponseWriter, _ *http.Request) { w.Header().Set("X-Content-Type-Options", "nosniff") if err := indexTpl.Execute(w, struct { - Customize customization.Customize - InlineContentNonce string - MaxSecretExpiry int64 - Version string + Customize customization.Customize + InlineContentNonce string + MaxSecretExpiry int64 + DefaultSecretExpiry int64 + Version string }{ - Customize: cust, - InlineContentNonce: inlineContentNonceStr, - MaxSecretExpiry: cfg.MaxSecretExpiry, - Version: version, + Customize: cust, + InlineContentNonce: inlineContentNonceStr, + MaxSecretExpiry: cfg.MaxSecretExpiry, + DefaultSecretExpiry: cfg.DefaultSecretExpiry, + Version: version, }); err != nil { http.Error(w, errors.Wrap(err, "executing template").Error(), http.StatusInternalServerError) return diff --git a/src/components/create.vue b/src/components/create.vue index 1ed40c6..515ea14 100644 --- a/src/components/create.vue +++ b/src/components/create.vue @@ -114,6 +114,8 @@