claude-hdb
a10349d835
Public tool, private state. cast holds no hostnames, no bindings, no secrets: it joins a product repo's .infra/ manifest with a state directory you point it at, and makes Coolify match. Extracted from heavy-duty/infra, which was half tool and half state — the inconsistency that made it impossible to say whether "infra" named a CLI or a runbook. rig builds the boxes; cast fills them; infra is what they are filled with. Two changes were required to make it genuinely stateless and publishable: - The implicit cwd contract (environments.yaml / secrets/ / .coolify.env resolved against the working directory, silently reading the wrong file from the wrong place) is now an explicit --state <dir> / $CAST_STATE. - BANNED_IN_PROD — a hardcoded list of one product's ALLOW_* flags, the only product knowledge in the executor — becomes the generic, operator- owned environments.<env>.forbidden_var_patterns. The guard now lives in private state, so a product-side change cannot lower its own guard, and it is a pattern rather than a list, so it catches unforeseen siblings. Age identities resolve as $CAST_AGE_KEY_FILE_<ENV> then ~/.config/cast/age-<env>.key — which is the entire attended-vs-unattended apply mechanism, with no environment names known to the tool. Instance identity (org names, the GitHub App name, founder domains) is out of the fixtures and out of register-github-app.sh, which took APP_NAME and ORG as arguments rather than baking them in. 69 tests green; bin/cast + curl installer mirror rig's shape. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
51 lines
1.9 KiB
TypeScript
51 lines
1.9 KiB
TypeScript
import { execFileSync } from "node:child_process";
|
|
import { existsSync } from "node:fs";
|
|
import { homedir } from "node:os";
|
|
import { join } from "node:path";
|
|
|
|
export function decryptSecrets(
|
|
file: string,
|
|
keyFile: string,
|
|
): Record<string, string> {
|
|
const out = execFileSync("age", ["-d", "-i", keyFile, file], {
|
|
encoding: "utf8",
|
|
});
|
|
const secrets: Record<string, string> = {};
|
|
for (const raw of out.split("\n")) {
|
|
const line = raw.trim();
|
|
if (line === "" || line.startsWith("#")) continue;
|
|
const eq = line.indexOf("=");
|
|
if (eq === -1)
|
|
throw new Error("age store: malformed line (expected KEY=value)");
|
|
secrets[line.slice(0, eq)] = line.slice(eq + 1);
|
|
}
|
|
return secrets;
|
|
}
|
|
|
|
// The age identity for an environment, resolved without cast knowing anything
|
|
// about your environment names:
|
|
//
|
|
// 1. $CAST_AGE_KEY_FILE_<ENV> — injected for this invocation
|
|
// 2. ~/.config/cast/age-<env>.key — a standing key on this machine
|
|
//
|
|
// This is the whole mechanism behind attended vs unattended applies: an
|
|
// environment whose key you never leave on disk can only be applied by an
|
|
// operator who injects it. Keep the key OUT of the state repo — the state repo
|
|
// holds ciphertext, never the identity that opens it.
|
|
export function keyFileFor(envName: string): string {
|
|
const injected = process.env[`CAST_AGE_KEY_FILE_${envName.toUpperCase()}`];
|
|
if (injected) return injected;
|
|
const standing = join(homedir(), ".config", "cast", `age-${envName}.key`);
|
|
if (existsSync(standing)) return standing;
|
|
throw new Error(
|
|
`no age key for ${envName}: set CAST_AGE_KEY_FILE_${envName.toUpperCase()} (attended apply) or place a standing key at ${standing}`,
|
|
);
|
|
}
|
|
|
|
export function secretsFileFor(
|
|
stateDir: string,
|
|
repoShortName: string,
|
|
envName: string,
|
|
): string {
|
|
return join(stateDir, "secrets", `${repoShortName}.${envName}.env.age`);
|
|
}
|