Skip to content

Commit 5f8a6d1

Browse files
treatrea
committed
initial commit
0 parents  commit 5f8a6d1

13 files changed

+1832
-0
lines changed

‎.github/CODE_OF_CONDUCT.md

+134
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
2+
# Contributor Covenant Code of Conduct
3+
4+
## Our Pledge
5+
6+
We as members, contributors, and leaders pledge to make participation in our
7+
community a harassment-free experience for everyone, regardless of age, body
8+
size, visible or invisible disability, ethnicity, sex characteristics, gender
9+
identity and expression, level of experience, education, socio-economic status,
10+
nationality, personal appearance, race, caste, color, religion, or sexual
11+
identity and orientation.
12+
13+
We pledge to act and interact in ways that contribute to an open, welcoming,
14+
diverse, inclusive, and healthy community.
15+
16+
## Our Standards
17+
18+
Examples of behavior that contributes to a positive environment for our
19+
community include:
20+
21+
* Demonstrating empathy and kindness toward other people
22+
* Being respectful of differing opinions, viewpoints, and experiences
23+
* Giving and gracefully accepting constructive feedback
24+
* Accepting responsibility and apologizing to those affected by our mistakes,
25+
and learning from the experience
26+
* Focusing on what is best not just for us as individuals, but for the overall
27+
community
28+
29+
Examples of unacceptable behavior include:
30+
31+
* The use of sexualized language or imagery, and sexual attention or advances of
32+
any kind
33+
* Trolling, insulting or derogatory comments, and personal or political attacks
34+
* Public or private harassment
35+
* Publishing others' private information, such as a physical or email address,
36+
without their explicit permission
37+
* Other conduct which could reasonably be considered inappropriate in a
38+
professional setting
39+
40+
## Enforcement Responsibilities
41+
42+
Community leaders are responsible for clarifying and enforcing our standards of
43+
acceptable behavior and will take appropriate and fair corrective action in
44+
response to any behavior that they deem inappropriate, threatening, offensive,
45+
or harmful.
46+
47+
Community leaders have the right and responsibility to remove, edit, or reject
48+
comments, commits, code, wiki edits, issues, and other contributions that are
49+
not aligned to this Code of Conduct, and will communicate reasons for moderation
50+
decisions when appropriate.
51+
52+
## Scope
53+
54+
This Code of Conduct applies within all community spaces, and also applies when
55+
an individual is officially representing the community in public spaces.
56+
Examples of representing our community include using an official e-mail address,
57+
posting via an official social media account, or acting as an appointed
58+
representative at an online or offline event.
59+
60+
## Enforcement
61+
62+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
63+
reported to the community leaders responsible for enforcement at
64+
[[email protected]](mailto:[email protected]).
65+
All complaints will be reviewed and investigated promptly and fairly.
66+
67+
All community leaders are obligated to respect the privacy and security of the
68+
reporter of any incident.
69+
70+
## Enforcement Guidelines
71+
72+
Community leaders will follow these Community Impact Guidelines in determining
73+
the consequences for any action they deem in violation of this Code of Conduct:
74+
75+
### 1. Correction
76+
77+
**Community Impact**: Use of inappropriate language or other behavior deemed
78+
unprofessional or unwelcome in the community.
79+
80+
**Consequence**: A private, written warning from community leaders, providing
81+
clarity around the nature of the violation and an explanation of why the
82+
behavior was inappropriate. A public apology may be requested.
83+
84+
### 2. Warning
85+
86+
**Community Impact**: A violation through a single incident or series of
87+
actions.
88+
89+
**Consequence**: A warning with consequences for continued behavior. No
90+
interaction with the people involved, including unsolicited interaction with
91+
those enforcing the Code of Conduct, for a specified period of time. This
92+
includes avoiding interactions in community spaces as well as external channels
93+
like social media. Violating these terms may lead to a temporary or permanent
94+
ban.
95+
96+
### 3. Temporary Ban
97+
98+
**Community Impact**: A serious violation of community standards, including
99+
sustained inappropriate behavior.
100+
101+
**Consequence**: A temporary ban from any sort of interaction or public
102+
communication with the community for a specified period of time. No public or
103+
private interaction with the people involved, including unsolicited interaction
104+
with those enforcing the Code of Conduct, is allowed during this period.
105+
Violating these terms may lead to a permanent ban.
106+
107+
### 4. Permanent Ban
108+
109+
**Community Impact**: Demonstrating a pattern of violation of community
110+
standards, including sustained inappropriate behavior, harassment of an
111+
individual, or aggression toward or disparagement of classes of individuals.
112+
113+
**Consequence**: A permanent ban from any sort of public interaction within the
114+
community.
115+
116+
## Attribution
117+
118+
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
119+
version 2.1, available at
120+
[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
121+
122+
Community Impact Guidelines were inspired by
123+
[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
124+
125+
For answers to common questions about this code of conduct, see the FAQ at
126+
[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
127+
[https://www.contributor-covenant.org/translations][translations].
128+
129+
[homepage]: https://www.contributor-covenant.org
130+
[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
131+
[Mozilla CoC]: https://github.com/mozilla/diversity
132+
[FAQ]: https://www.contributor-covenant.org/faq
133+
[translations]: https://www.contributor-covenant.org/translations
134+

‎.github/workflows/build.yml

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: "Test"
2+
3+
on:
4+
push
5+
6+
7+
jobs:
8+
9+
build:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
contents: 'read'
13+
id-token: 'write'
14+
steps:
15+
- uses: actions/checkout@v3
16+
17+
- name: Set up Go
18+
uses: actions/setup-go@v3
19+
with:
20+
go-version: "1.20"
21+
22+
- name: Build
23+
run: go build -v ./...
24+
25+
- name: Authenticate with Google for integration testing
26+
uses: google-github-actions/auth@v1
27+
with:
28+
workload_identity_provider: 'projects/956203386705/locations/global/workloadIdentityPools/workload-identity-pool/providers/github-actions-provider'
29+
service_account: 'github-integration-testing@caddy-gcp-secret-manager.iam.gserviceaccount.com'
30+
31+
- name: Test
32+
run: go test -coverprofile cover.out -v ./...
33+
env:
34+
INTEGRATION_PROJECT_ID: "caddy-gcp-secret-manager"
35+
36+
- name: Convert coverage to HTML
37+
run: go tool cover -html=cover.out -o coverage.html
38+
39+
- name: Upload coverage
40+
uses: actions/upload-artifact@v3
41+
with:
42+
name: "coverage-${{ github.sha }}.html"
43+
path: "coverage.html"

‎.gitignore

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
.idea
2+
cover.out
3+
coverage.html
4+
*.json

‎CONTRIBUTING.md

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Contributing to caddy-gcp-secret-manager
2+
3+
Thanks for your interest in contributing to the project! Below are some guidelines that you should follow
4+
in addition the [Code of Conduct](./.github/CODE_OF_CONDUCT.md).
5+
6+
## Report an Issue
7+
8+
If you have discovered a bug or defect in the software contained in this repository, [open an issue](https://github.com/trea/caddy-gcp-secret-manager/issues/new). Please be sure to
9+
include as much detail as possible including:
10+
11+
- What the defect is
12+
- Any potential suggestions of a solution for the defect
13+
- Any configuration details you can share
14+
- Version of this software being used
15+
- Installation method used
16+
- If built from source:
17+
- Versions of:
18+
- [Caddy](https://github.com/caddyserver/caddy)/[xcaddy](https://github.com/caddyserver/xcaddy)
19+
- [CertMagic](https://github.com/caddyserver/certmagic)
20+
- Go
21+
22+
## Feature Requests
23+
24+
This software is very narrowly focused and should likely be considered feature complete.
25+
26+
Notable exceptions would be if any of the dependencies change. Especially any of the following:
27+
28+
- [Caddy](https://github.com/caddyserver/caddy)
29+
- [CertMagic](https://github.com/caddyserver/certmagic)
30+
- [Google APIs Client Library for Go](https://github.com/googleapis/google-api-go-client)
31+
32+
## Pull Requests
33+
34+
Before undertaking any significant effort on anything in this repository, it should be discussed first. Please participate in that discussion in the applicable issue or PR, or [create an issue](https://github.com/trea/caddy-gcp-secret-manager/issues/new).
35+
36+
Beyond that, please ensure that as part of any work you:
37+
38+
- [Sign your commits](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits)
39+
- Add tests where possible and necessary
40+
- Ensure that any new changes don't break tests, or fix the broken tests as necessary
41+
42+
## Security
43+
44+
If you believe you have identified a security issue in the project, _please **do not** create a public issue_. Instead, report any potential vulnerabilities on the security page of the repository. You may also email the
45+
maintainer of this repository directly at [[email protected]](mailto:[email protected]?subject=caddy-gcp-secret-manager%20Security%20Issue).
46+
47+
You will receive acknowledgement of the report right away. I will commit to triaging and remediating the issue as soon as possible.
48+
49+
Once any discovered vulnerabilities are repaired, you will be publicly credited for the discovery.

‎LICENSE

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Copyright © 2023 Trea Hauet <[email protected]>
2+
3+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
4+
5+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
6+
7+
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

‎Makefile

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
.PHONY: tests
2+
tests:
3+
go test ./...
4+
5+
.PHONY: coverage
6+
coverage:
7+
go test -coverprofile cover.out ./...
8+
go tool cover -html=cover.out

‎README.md

+123
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
# caddy-gcp-secret-manager
2+
3+
This package provides a module for the [Caddy](https://github.com/caddyserver/caddy) web server to use [Google Cloud Platform's Secret Manager](https://cloud.google.com/secret-manager/) product to store
4+
TLS certificates.
5+
6+
## Features
7+
8+
- Secure retrieval and storage of TLS certificates
9+
- Clustering compatible - locks with TTLs are written to Secret Manager
10+
11+
## Usage
12+
13+
### Building
14+
15+
To use this module with Caddy, you'll need to create a custom build with [`xcaddy`](https://github.com/caddyserver/xcaddy).
16+
17+
```bash
18+
xcaddy build --with github.com/trea/caddy-gcp-secret-manager
19+
```
20+
21+
#### Via Docker
22+
23+
You can build this module (and others) into Caddy with `xcaddy` using Docker. The following example uses a multi-phase build to build the
24+
Caddy binary with xcaddy, and then copies your newly built binary over the original binary in the core Caddy image.
25+
26+
```Dockerfile
27+
FROM caddy:2.6.4-builder AS builder
28+
29+
RUN xcaddy --with github.com/trea/caddy-gcp-secret-manager
30+
31+
FROM caddy:2.6.4
32+
33+
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
34+
```
35+
36+
<!-- TODO: Document Caddy download page https://caddyserver.com/download -->
37+
38+
## Caddyfile Configuration Examples
39+
40+
### Application Default Credentials
41+
The Google Cloud Platform Client library used by this package uses [Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials) by default
42+
which can automatically configure authentication and authorization.
43+
44+
The following configuration would use Caddy's static file server to serve files in /var/www/html at https://example.com and the TLS certificate will be stored in GCP Secret Manager.
45+
46+
`your-project-id` should be replaced with the Project ID for your project from your Google Cloud Platform console.
47+
48+
```
49+
{
50+
storage gcp-secret-manager your-project-id
51+
}
52+
53+
example.com:443 {
54+
file_server /var/www/html
55+
}
56+
```
57+
58+
### Specified Credentials
59+
60+
If you need to point to a specific credentials file, you can do so in configuration as well by setting the `credentials_file` option nested
61+
under the `storage` block.
62+
63+
```
64+
{
65+
storage gcp-secret-manager your-project-id {
66+
credentials_file /mnt/gcp-credentials.json
67+
}
68+
}
69+
70+
example.com:443 {
71+
file_server /var/www/html
72+
}
73+
```
74+
75+
## Use with certmagic
76+
77+
Because Caddy's TLS is built on top of [certmagic](https://github.com/caddyserver/certmagic), this package can be used with certmagic directly like so:
78+
79+
```go
80+
package main
81+
82+
import (
83+
"log"
84+
"net/http"
85+
86+
"github.com/caddyserver/certmagic"
87+
88+
caddy_gcp_secret_manager "github.com/trea/caddy-gcp-secret-manager"
89+
)
90+
91+
func main() {
92+
93+
storage, err := caddy_gcp_secret_manager.NewSecretManagerStorage("my-gcp-project")
94+
95+
if err != nil {
96+
log.Fatalf("Unable to initialize storage: %+v", err)
97+
}
98+
99+
// read and agree to your CA's legal documents
100+
// provide an email address
101+
// use the staging endpoint while we're developing
102+
//
103+
// uncomment and change the values on the following lines as applicable
104+
105+
//certmagic.DefaultACME.Agreed = true
106+
//certmagic.DefaultACME.Email = "[email protected]"
107+
//certmagic.DefaultACME.CA = certmagic.LetsEncryptStagingCA
108+
109+
certmagic.Default.Storage = storage
110+
111+
mux := http.NewServeMux()
112+
mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
113+
w.Write([]byte("Hello world!"))
114+
})
115+
116+
if err := certmagic.HTTPS([]string{"example.com"}, mux); err != nil {
117+
log.Fatalf("Unable to start listener: %+v", err)
118+
}
119+
}
120+
```
121+
122+
`NewSecretManagerStorage` also accepts [`option.ClientOption`](https://pkg.go.dev/google.golang.org/api/option#ClientOption) if you need to alter connection configuration as shown in the client
123+
[examples](https://github.com/googleapis/google-cloud-go#authorization).

0 commit comments

Comments
 (0)