Build local product stack with Vault-managed secrets (#42)

dev/vault.py

@@ -0,0 +1,117 @@
+"""Local Vault bootstrap API; response bodies with secrets never reach logs."""
+import json
+import os
+from pathlib import Path
+import time
+import urllib.error
+import urllib.request
+
+STATE = Path(__file__).resolve().parents[1] / '.local' / 'dev'
+URL = 'http://127.0.0.1:18200/v1/'
+
+
+def write(path, value, mode=0o600):
+    path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    tmp = path.with_name(path.name + '.tmp')
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, mode)
+    with os.fdopen(fd, 'w') as out:
+        out.write(value)
+    os.chmod(tmp, mode)
+    os.replace(tmp, path)
+
+
+class Vault:
+    def __init__(self):
+        self.token = None
+
+    def call(self, path, data=None, method=None, missing=False):
+        headers = {'Content-Type': 'application/json'}
+        if self.token:
+            headers['X-Vault-Token'] = self.token
+        req = urllib.request.Request(URL + path, headers=headers,
+            data=json.dumps(data).encode() if data is not None else None, method=method)
+        try:
+            with urllib.request.urlopen(req, timeout=30) as response:
+                body = response.read()
+                return json.loads(body) if body else {}
+        except urllib.error.HTTPError as error:
+            if error.code == 404 and missing:
+                return None
+            raise RuntimeError(f'Vault {path} returned HTTP {error.code}') from None
+
+    def initialize(self):
+        for attempt in range(90):
+            try:
+                initialized = self.call('sys/init')['initialized']
+                break
+            except (urllib.error.URLError, ConnectionError):
+                time.sleep(1)
+        else:
+            raise RuntimeError('Vault did not start within 90 seconds')
+        initfile = STATE / 'admin' / 'init.json'
+        if not initialized:
+            if initfile.exists():
+                raise RuntimeError('Vault data is missing but bootstrap material exists; restore the matching volume or explicitly reset both')
+            init = self.call('sys/init', {'secret_shares': 1, 'secret_threshold': 1})
+            write(initfile, json.dumps(init))
+        if not initfile.exists():
+            raise RuntimeError('Missing .local/dev/admin/init.json for initialized Vault; restore the matching bootstrap material')
+        init = json.loads(initfile.read_text())
+        self.token = init['root_token']
+        write(STATE / 'vault' / 'unseal', init['keys_base64'][0], 0o444)
+        for attempt in range(60):
+            if not self.call('sys/seal-status')['sealed']:
+                return
+            time.sleep(1)
+        raise RuntimeError('Vault did not unseal within 60 seconds')
+
+    def existing(self):
+        self.token = json.loads((STATE / 'admin' / 'init.json').read_text())['root_token']
+
+    def kv(self, path):
+        result = self.call('kv/data/' + path, missing=True)
+        return result['data']['data'] if result else None
+
+    def put(self, path, data):
+        self.call('kv/data/' + path, {'data': data})
+
+    def ensure(self, path, factory):
+        value = self.kv(path)
+        if value is None:
+            value = factory()
+            self.put(path, value)
+        return value
+
+    def random(self, length=32):
+        return self.call('sys/tools/random', {'bytes': length, 'format': 'hex'})['data']['random_bytes']
+
+    def mounts(self):
+        mounts = self.call('sys/mounts')['data']
+        for name, kind in [('kv', 'kv'), ('database', 'database'), ('pki', 'pki')]:
+            if name + '/' not in mounts:
+                settings = {'type': kind}
+                if kind == 'kv':
+                    settings['options'] = {'version': '2'}
+                self.call('sys/mounts/' + name, settings)
+        auth = self.call('sys/auth')['data']
+        if 'approle/' not in auth:
+            self.call('sys/auth/approle', {'type': 'approle'})
+
+    def certificates(self):
+        self.call('sys/mounts/pki/tune', {'max_lease_ttl': '87600h'})
+        ca = self.kv('tls')
+        if ca is None:
+            result = self.call('pki/root/generate/internal', {'common_name': 'SXCHNGE local development CA', 'ttl': '87600h'})['data']
+            ca = {'ca': result['certificate']}
+            self.put('tls', ca)
+        self.call('pki/roles/local', {'allowed_domains': ['localhost', 'notifications'],
+            'allow_bare_domains': True, 'allow_ip_sans': True, 'max_ttl': '720h'})
+        for name, host in [('notifications-tls', 'notifications'), ('frontend-tls', 'localhost')]:
+            cert = self.kv(name)
+            if cert is None or cert['expiration'] < time.time() + 7 * 86400:
+                cert = self.call('pki/issue/local', {'common_name': host, 'ip_sans': '127.0.0.1', 'ttl': '720h'})['data']
+                self.put(name, cert)
+            if name == 'frontend-tls':
+                write(STATE / 'frontend' / 'server.crt', cert['certificate'])
+                write(STATE / 'frontend' / 'server.key', cert['private_key'])
+        write(STATE / 'ca.pem', ca['ca'], 0o644)