@clef-sh/agent 0.1.7-beta.45 → 0.1.7-beta.48
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +79 -0
- package/dist/agent.cjs +1 -1
- package/dist/agent.cjs.map +1 -1
- package/package.json +1 -1
package/README.md
ADDED
|
@@ -0,0 +1,79 @@
|
|
|
1
|
+
# @clef-sh/agent
|
|
2
|
+
|
|
3
|
+
Sidecar secrets agent for [Clef](https://clef.sh). Wraps `@clef-sh/runtime` in an HTTP API that serves decrypted secrets on `127.0.0.1:7779`. Deploy as a sidecar container, a daemon process, or an AWS Lambda extension.
|
|
4
|
+
|
|
5
|
+
## Install
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
npm install @clef-sh/agent
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
Or use the standalone binary (no Node.js required):
|
|
12
|
+
|
|
13
|
+
```bash
|
|
14
|
+
# Download from GitHub releases
|
|
15
|
+
curl -Lo clef-agent https://github.com/clef-sh/clef/releases/latest/download/clef-agent-linux-x64
|
|
16
|
+
chmod +x clef-agent
|
|
17
|
+
```
|
|
18
|
+
|
|
19
|
+
## Usage
|
|
20
|
+
|
|
21
|
+
```bash
|
|
22
|
+
# Point at an HTTP artifact source (S3, CDN, broker URL)
|
|
23
|
+
export CLEF_AGENT_SOURCE=https://my-bucket.s3.amazonaws.com/clef/api-gateway/production.age.json
|
|
24
|
+
export CLEF_AGENT_TOKEN=$(openssl rand -hex 32)
|
|
25
|
+
|
|
26
|
+
clef-agent
|
|
27
|
+
# Listening on http://127.0.0.1:7779
|
|
28
|
+
```
|
|
29
|
+
|
|
30
|
+
Your application reads secrets via HTTP:
|
|
31
|
+
|
|
32
|
+
```bash
|
|
33
|
+
curl -H "Authorization: Bearer $CLEF_AGENT_TOKEN" http://127.0.0.1:7779/v1/secrets
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
## API
|
|
37
|
+
|
|
38
|
+
| Endpoint | Auth | Description |
|
|
39
|
+
| ---------------------- | ------ | -------------------------------------------------- |
|
|
40
|
+
| `GET /v1/health` | No | Health check with revision and expiry status |
|
|
41
|
+
| `GET /v1/ready` | No | Readiness probe (503 until first decrypt succeeds) |
|
|
42
|
+
| `GET /v1/secrets` | Bearer | All secrets as key-value JSON |
|
|
43
|
+
| `GET /v1/secrets/:key` | Bearer | Single secret by key |
|
|
44
|
+
| `GET /v1/keys` | Bearer | List available key names |
|
|
45
|
+
|
|
46
|
+
## Security
|
|
47
|
+
|
|
48
|
+
- Binds exclusively to `127.0.0.1` — never `0.0.0.0`
|
|
49
|
+
- Timing-safe bearer token authentication
|
|
50
|
+
- DNS rebinding protection via Host header validation
|
|
51
|
+
- `Cache-Control: no-store` on all secrets endpoints
|
|
52
|
+
- KMS envelope mode requires no static age key — IAM role is the authentication
|
|
53
|
+
|
|
54
|
+
## Configuration
|
|
55
|
+
|
|
56
|
+
| Variable | Required | Default | Description |
|
|
57
|
+
| ---------------------------- | -------- | ------- | --------------------------------------------- |
|
|
58
|
+
| `CLEF_AGENT_SOURCE` | Yes\* | — | HTTP URL or file path to a packed artifact |
|
|
59
|
+
| `CLEF_AGENT_VCS_PROVIDER` | Yes\* | — | VCS provider (github, gitlab, bitbucket) |
|
|
60
|
+
| `CLEF_AGENT_VCS_REPO` | Yes\* | — | Repository (org/repo) |
|
|
61
|
+
| `CLEF_AGENT_VCS_TOKEN` | Yes\* | — | VCS authentication token |
|
|
62
|
+
| `CLEF_AGENT_VCS_IDENTITY` | Yes\* | — | Service identity name |
|
|
63
|
+
| `CLEF_AGENT_VCS_ENVIRONMENT` | Yes\* | — | Target environment |
|
|
64
|
+
| `CLEF_AGENT_PORT` | No | 7779 | HTTP listen port |
|
|
65
|
+
| `CLEF_AGENT_TOKEN` | No | auto | Bearer token (auto-generated if not set) |
|
|
66
|
+
| `CLEF_AGENT_AGE_KEY` | No | — | Age private key (not needed for KMS envelope) |
|
|
67
|
+
| `CLEF_AGENT_CACHE_TTL` | No | 300 | Max seconds to serve without refresh |
|
|
68
|
+
|
|
69
|
+
\_Provide either `SOURCE` or the `VCS\__` fields.
|
|
70
|
+
|
|
71
|
+
## Documentation
|
|
72
|
+
|
|
73
|
+
- [Runtime Agent guide](https://docs.clef.sh/guide/agent)
|
|
74
|
+
- [Service Identities guide](https://docs.clef.sh/guide/service-identities)
|
|
75
|
+
- [Dynamic Secrets guide](https://docs.clef.sh/guide/dynamic-secrets)
|
|
76
|
+
|
|
77
|
+
## License
|
|
78
|
+
|
|
79
|
+
MIT
|
package/dist/agent.cjs
CHANGED
|
@@ -184478,7 +184478,7 @@ var Daemon = class {
|
|
|
184478
184478
|
};
|
|
184479
184479
|
|
|
184480
184480
|
// package.json
|
|
184481
|
-
var version5 = "0.1.7-beta.
|
|
184481
|
+
var version5 = "0.1.7-beta.48";
|
|
184482
184482
|
|
|
184483
184483
|
// src/main.ts
|
|
184484
184484
|
async function main() {
|