cipherpipe 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 15b425e50ef35bf3fc0b593f4c4c7e8b356704fb00e8319e635e05062c8f5fc5
-  data.tar.gz: 66aaa053fc30dd29b72552bfd1374143ce300a8da80d716fdd870e65a8553d20
+  metadata.gz: e9b2fab8ec6b717ba29bc3c22384079406026f74695a132edf66d874d5d15314
+  data.tar.gz: bf35ea57b17d3ff040fae15078ed8d303330d318a6067903a0c89e0f57e41d3b
 SHA512:
-  metadata.gz: c1c251974d2c8b78835b568c3b9174e7d5e603e3f345a91b801c9d24e7929a0612f6043dd16be6135da6e3038f50055081275c29fdc71256923dcbb9a0297c56
-  data.tar.gz: b703b2dd774baeead92f5f713c1436503c56d1ca80ebbeed0436366375450ce71f73f1f0a3109ed518c04c9db9e05844f9d68fc3c6739d8080a4a3a047ce4043
+  metadata.gz: b19efd4d039824f3222d8dc53b8279712acf2d5ecf203e199901fa65b656c4a29bf1b122eaf7e71d2b8d2e0e823dbbcb864ae6e0fa1b4f4a558589309da325bc
+  data.tar.gz: 076ad3592c79152537e8afae5db73c8d6e6b4025272738dacf2b9f123380a82141691beca3f483635773377020ce456befb8ba94f6dc792f5ce612a9580dd455

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    cipherpipe (0.1.0)
+    cipherpipe (0.2.0)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -32,6 +32,8 @@ And add the following to an initializer to load the secrets:
 Cipherpipe::Commands::Load.call
 ```
 
+If you're using Vault's EC2 authentication and have specified an `ec2_role` value for the primary source (as noted in the configuration example below), then loading the secrets will automatically authenticate against Vault using the EC2 instance's PKCS7-signed identity.
+
 ## Configuration
 
 Everything for Cipherpipe is managed in a YAML configuration file `.cipherpipe.yml` which you should place in the root of your project. You'll need to specify at least one source (and mark it as the primary). Having an output file/format is optional, but likely useful.
@@ -49,6 +51,18 @@ sources:
   primary: true
 ```
 
+If you're running this on EC2 servers that are set up to authenticate with Vault via a specific role, you can provide that with the `ec2_role` setting and it'll automatically be used:
+
+```yml
+file: .env.ENVIRONMENT
+format: env
+sources:
+- type: vault
+  destination: apps/myapp/ENVIRONMENT
+  primary: true
+  ec2_role: servers
+```
+
 Another example, for use with a Terraform project:
 
 ```yml
@@ -85,6 +99,10 @@ Uploading will take the data from the configured file and send it to all of the
 
 Make sure that the configured secrets file is _not_ stored in version control. The `.cipherpipe.yml` file, however, should definitely be stored.
 
+If you're using Vault's EC2 authentication and have specified an `ec2_role` value for the primary source, you can automatically save a token for your system user (in `~/.vault-token`) with the `ec2` command:
+
+    $ cipherpipe ec2
+
 ## Dependencies
 
 If you're using Vault (which is likely, given it's currently the only supported secret storage service), you'll need to make sure it's using the V2 kv secrets engine.

data/cipherpipe.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |spec|
   spec.name          = "cipherpipe"
-  spec.version       = "0.1.0"
+  spec.version       = "0.2.0"
   spec.authors       = ["Pat Allan"]
   spec.email         = ["pat@freelancing-gods.com"]
 

data/lib/cipherpipe/cli.rb

@@ -5,6 +5,8 @@ class Cipherpipe::CLI
       Cipherpipe::Commands::Upload.call configuration
     when "download"
       Cipherpipe::Commands::Download.call configuration
+    when "ec2"
+      Cipherpipe::Commands::EC2.call configuration
     else
       Cipherpipe::Commands::Help.call configuration
     end

data/lib/cipherpipe/commands/ec2.rb

@@ -0,0 +1,36 @@
+class Cipherpipe::Commands::EC2
+  TOKEN_FILE = File.expand_path("~/.vault-token")
+
+  def self.call(configuration = nil)
+    new(configuration).call
+  end
+
+  def initialize(configuration)
+    @configuration = configuration
+  end
+
+  def call
+    require_relative "../vault"
+    require_relative "../vault/ec2_token"
+
+    if external_source.ec2_role.nil?
+      puts "No EC2 role is defined, so EC2 authentication is not possible."
+    else
+      File.write TOKEN_FILE, Cipherpipe::Vault::EC2Token.call(external_source)
+    end
+  rescue Cipherpipe::Vault::EC2Token::ConnectionError => error
+    warn error.message
+  end
+
+  private
+
+  def configuration
+    @configuration ||= Cipherpipe::Configuration.new
+  end
+
+  def external_source
+    @external_source ||= configuration.external_sources.detect { |source|
+      source.primary?
+    }
+  end
+end

data/lib/cipherpipe/commands/help.rb

@@ -12,6 +12,9 @@ class Cipherpipe::Commands::Help
 
         cipherpipe download # loads the secrets from the primary source
         cipherpipe upload   # uploads secrets to all sources
+        cipherpipe ec2      # authenticate your user using Vault's EC2 approach.
+                            # This command will overwrite your ~/.vault-token
+                            # file.
 
       TXT
   end

data/lib/cipherpipe/configuration.rb

@@ -52,7 +52,8 @@ class Cipherpipe::Configuration
     Cipherpipe::ExternalSource.new(
       hash["type"],
       hash["destination"].gsub("ENVIRONMENT", environment),
-      hash["primary"]
+      hash["primary"],
+      hash["ec2_role"]
     )
   end
 

data/lib/cipherpipe/external_source.rb

@@ -1,12 +1,13 @@
 class Cipherpipe::ExternalSource
   UnknownProviderError = Class.new Cipherpipe::Error
 
-  attr_reader :type, :destination, :primary
+  attr_reader :type, :destination, :primary, :ec2_role
 
-  def initialize(type, destination, primary = false)
+  def initialize(type, destination, primary = false, ec2_role = nil)
     @type        = type
     @destination = destination
     @primary     = primary
+    @ec2_role    = ec2_role
   end
 
   def download

data/lib/cipherpipe/vault/ec2_token.rb

@@ -0,0 +1,36 @@
+require "uri"
+require "net/http"
+require "vault"
+
+class Cipherpipe::Vault::EC2Token
+  ConnectionError = Class.new Cipherpipe::Error
+  URL             = URI.parse(
+    "http://169.254.169.254/latest/dynamic/instance-identity/pkcs7"
+  )
+
+  def self.call(external_source)
+    new(external_source).call
+  end
+
+  def initialize(external_source)
+    @external_source = external_source
+  end
+
+  def call
+    ::Vault.auth.aws_ec2(
+      external_source.ec2_role, signature
+    ).auth.client_token
+  end
+
+  private
+
+  attr_reader :external_source
+
+  def signature
+    http = Net::HTTP.new URL.host, URL.port
+    http.open_timeout = 1 # second
+    http.request_get(URL.path).body.gsub("\n", "")
+  rescue Net::OpenTimeout => error
+    raise ConnectionError, "Unable to read the local EC2 information endpoint"
+  end
+end

data/lib/cipherpipe/vault.rb

@@ -6,6 +6,7 @@ class Cipherpipe::Vault
   def self.download(external_source)
     require_relative "vault/download"
 
+    set_token external_source
     Cipherpipe::Vault::Download.call external_source
   end
 
@@ -14,4 +15,13 @@ class Cipherpipe::Vault
 
     Cipherpipe::Vault::Upload.call external_source, settings
   end
+
+  def self.set_token(external_source)
+    return unless external_source.ec2_role
+
+    require_relative "vault/ec2_token"
+    ::Vault.client.token = Cipherpipe::Vault::EC2Token.call external_source
+  rescue Cipherpipe::Vault::EC2Token::ConnectionError => error
+    warn error.message
+  end
 end

data/lib/cipherpipe.rb

@@ -5,6 +5,7 @@ module Cipherpipe
 end
 
 require_relative "cipherpipe/commands/download"
+require_relative "cipherpipe/commands/ec2"
 require_relative "cipherpipe/commands/help"
 require_relative "cipherpipe/commands/load"
 require_relative "cipherpipe/commands/upload"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cipherpipe
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Pat Allan
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-06-06 00:00:00.000000000 Z
+date: 2018-06-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -89,6 +89,7 @@ files:
 - lib/cipherpipe.rb
 - lib/cipherpipe/cli.rb
 - lib/cipherpipe/commands/download.rb
+- lib/cipherpipe/commands/ec2.rb
 - lib/cipherpipe/commands/help.rb
 - lib/cipherpipe/commands/load.rb
 - lib/cipherpipe/commands/upload.rb
@@ -101,6 +102,7 @@ files:
 - lib/cipherpipe/vault.rb
 - lib/cipherpipe/vault/api.rb
 - lib/cipherpipe/vault/download.rb
+- lib/cipherpipe/vault/ec2_token.rb
 - lib/cipherpipe/vault/upload.rb
 homepage: https://github.com/limbrapp/cipherpipe
 licenses: