@coffre/cli 0.1.0 → 0.1.2

package/dist/templates/node/vault.env.example

@@ -2,15 +2,14 @@
 # the vault's user alone.
 
 VAULT_SOCKET=vault.sock
-# The server's Postgres database, as the vault's own login.
+# From `coffre setup`: the server's database, as the vault's own login.
 DATABASE_URL=postgres://coffre_vault_runtime:CHANGE_ME@127.0.0.1:5432/coffre
 
-# The key-encryption key: 32 random bytes, base64 (`openssl rand -base64 32`),
-# and a name for it. A rotation gives the new one a new name.
+# From `coffre setup`, saved in your password manager first: the
+# key-encryption key, and its name. A rotation gives the new one a new name.
+# The vault derives the key it signs its records with from it.
 KEK_ID=kek-1
 KEK=
-# 32 random bytes, base64: signs the audit checkpoints.
-SIGNING_KEY=
 
 # Comma-separated emails: the first people in, whom nobody can remove.
 ROOT_ADMINS=you@example.com

package/dist/templates/workers/README.md

@@ -17,63 +17,61 @@ Worker secrets. Everything below runs from this directory.
 - `app/wrangler.jsonc`: `PUBLIC_URL`, and `GITHUB_CLIENT_ID` from a GitHub
   OAuth app whose callback is `<PUBLIC_URL>/auth/callback/github`.
 - `vault/wrangler.jsonc`: `ROOT_ADMINS`, the emails of the first people in,
-  and `KEK_ID`, a name for the key-encryption key below.
+  and `KEK_ID`, which `coffre setup` gives you below.
 
-## 2. The database
+## 2. The database and keys
 
-coffre wants a Postgres database with three logins: its owner, for
-migrations; `coffre_runtime`, which the app runs as; and
-`coffre_vault_runtime`, which the vault runs as. Create the two as plain
-logins. As the database's administrator, connect with `psql` and run:
-
-```sql
-CREATE ROLE coffre_runtime LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
-CREATE ROLE coffre_vault_runtime LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
-\password coffre_runtime
-\password coffre_vault_runtime
-```
-
-Each `\password` prompts for a different generated password. The owner
-must be able to create and grant roles: the migration creates `coffre_app`
-and `coffre_vault`, and grants each login its own group. Only the vault may
-write members and grants, and each appends to the log only as itself.
-URL-encode special characters in the passwords in these URLs:
+Make a Postgres database, then, from this directory:
 
 ```sh
-pnpm install
-pnpm migrate "postgres://owner:…@db.example.com:5432/coffre"
-pnpm exec wrangler hyperdrive create coffre --caching-disabled \
-  --connection-string="postgres://coffre_runtime:…@db.example.com:5432/coffre"
-pnpm exec wrangler hyperdrive create coffre-vault --caching-disabled \
-  --connection-string="postgres://coffre_vault_runtime:…@db.example.com:5432/coffre"
+npx @coffre/cli setup
 ```
 
-Keep `--caching-disabled`: Hyperdrive otherwise caches reads for up to a
-minute, and a revoked token or a signed-out session could keep working that
-long. `wrangler.jsonc` cannot set it, so for a config made another way,
-check `caching` in `wrangler hyperdrive get <id>`.
+Run it with the CLI you ran `coffre init` with. It asks for the database
+administrator's connection string at a hidden prompt (a script can pipe it
+in, or set `COFFRE_SETUP_DATABASE_URL`; never pass it as an argument). It
+makes the two logins coffre runs as, `coffre_runtime` for the app and
+`coffre_vault_runtime` for the vault, migrates the database, checks that
+each login holds only its rights, and prints every value at once: the two
+keys, the KEK's id, and each login's connection string. It keeps no copy and
+writes no file. Save its output in your password manager, with the GitHub
+client secret, before anything else. There is one key for each Worker, so
+that the app, which faces the network, never holds what decrypts a value:
+
+- `KEK`, the vault's, decrypts every value, and the vault derives from it the
+  key it signs its records with. Lose it, and every value is lost.
+- `AUDIT_CHAIN_KEY`, the app's, signs the app's log entries, sessions and
+  tokens. Lose it, and everyone is signed out and the log stops verifying.
+
+To do the same by hand, see
+[deploy.md](https://github.com/erwinkn/coffre/blob/main/docs/deploy.md#appendix-the-database-by-hand).
+
+## 3. Hyperdrive and secrets
+
+Run the two `wrangler hyperdrive create` commands setup printed: one config
+per login, each `--caching-disabled`. Hyperdrive otherwise caches reads for
+up to a minute, and a revoked token or a signed-out session could keep
+working that long. `wrangler.jsonc` cannot set it, so for a config made
+another way, check `caching` in `wrangler hyperdrive get <id>`.
 
 Put the ids they print under `hyperdrive`, the first in
-`app/wrangler.jsonc` and the second in `vault/wrangler.jsonc`. Run
-`pnpm migrate` again after every upgrade of `@coffre/server`, before
-deploying it.
-
-## 3. Secrets
-
-Generate three separate keys with `openssl rand -base64 32` and save them
-in your password manager first. The commands below prompt for the saved
-values; save the GitHub client secret there too.
+`app/wrangler.jsonc` and the second in `vault/wrangler.jsonc`, and `KEK_ID`
+in `vault/wrangler.jsonc`. Then set the secrets; each command prompts for
+the saved value:
 
 ```sh
 pnpm exec wrangler secret put KEK -c vault/wrangler.jsonc
-pnpm exec wrangler secret put SIGNING_KEY -c vault/wrangler.jsonc
 pnpm exec wrangler secret put AUDIT_CHAIN_KEY -c app/wrangler.jsonc
 pnpm exec wrangler secret put GITHUB_CLIENT_SECRET -c app/wrangler.jsonc
 ```
 
-Escrow `KEK` with its `KEK_ID`, `SIGNING_KEY` and `AUDIT_CHAIN_KEY`.
-Without the KEK, stored values cannot be read; without the other keys, the
-existing log cannot be verified. Keep older KEKs after rotation too.
+Run `pnpm migrate`, with the administrator's URL in `DATABASE_URL`, after
+every upgrade of `@coffre/server`, before deploying it.
+
+Keep older KEKs after a rotation, for good: what they wrapped still needs
+them, and so does what the vault signed under them before it. With AWS KMS
+instead of a key of your own, the vault also needs a `SIGNING_KEY`
+([keys](https://github.com/erwinkn/coffre/blob/main/docs/keys.md#aws-kms)).
 
 ## 4. Deploy
 

package/dist/templates/workers/app/wrangler.jsonc

@@ -17,6 +17,7 @@
     "GITHUB_CLIENT_ID": "replace-with-your-client-id"
   },
   "secrets": {
+    // AUDIT_CHAIN_KEY is from `coffre setup`; the app never gets the vault's keys.
     "required": ["GITHUB_CLIENT_SECRET", "AUDIT_CHAIN_KEY"]
   },
   // `wrangler hyperdrive create coffre --caching-disabled --connection-string=<runtime login URL>`

package/dist/templates/workers/package.json

@@ -14,13 +14,13 @@
     "conformance": "coffre-conformance workers"
   },
   "dependencies": {
-    "@coffre/server": "0.1.0",
-    "@coffre/ui": "0.1.0",
-    "@coffre/vault": "0.1.0"
+    "@coffre/server": "0.1.2",
+    "@coffre/ui": "0.1.2",
+    "@coffre/vault": "0.1.2"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "5.20260920.1",
-    "@coffre/conformance": "0.1.0",
+    "@coffre/conformance": "0.1.2",
     "typescript": "5.9.3",
     "wrangler": "4.118.0"
   }

package/dist/templates/workers/vault/src/worker.ts

@@ -7,15 +7,16 @@ type Env = {
   VAULT_HYPERDRIVE: Hyperdrive;
   KEK_ID: string;
   KEK: string;
-  SIGNING_KEY: string;
   ROOT_ADMINS: string;
 };
 
 export default vault((env: Env) => ({
   database: postgres(env.VAULT_HYPERDRIVE),
   kek: { id: env.KEK_ID, key: env.KEK },
-  // After a rotation, the KEKs before it, so the data keys they wrapped
-  // still open: previousKeks: [{ id: 'kek-2026-09', key: env.KEK_2026_09 }],
+  // After a rotation, the KEKs before it, so the data keys they wrapped still
+  // open and the records signed under them before it still verify:
+  // previousKeks: [{ id: 'kek-2026-09', key: env.KEK_2026_09 }],
   rootAdmins: env.ROOT_ADMINS.split(',').map((email) => email.trim()),
-  signingKey: env.SIGNING_KEY,
+  // The vault derives its signing key from the KEK. With a KEK a key service
+  // holds, such as awsKms(…), it needs one of its own: signingKey: env.SIGNING_KEY.
 }));

package/dist/templates/workers/vault/wrangler.jsonc

@@ -11,14 +11,15 @@
   "workers_dev": false,
   "observability": { "enabled": true },
   "vars": {
-    // Names the KEK below; a rotation gives the new one a new id.
+    // Names the KEK below: from `coffre setup`. A rotation gives the new one a new id.
     "KEK_ID": "kek-1",
     // Comma-separated emails: the first people in, whom nobody can remove.
     "ROOT_ADMINS": "you@example.com"
   },
   "secrets": {
-    // Each 32 random bytes, base64: `openssl rand -base64 32`.
-    "required": ["KEK", "SIGNING_KEY"]
+    // From `coffre setup`: wrangler secret put KEK. The vault derives the key
+    // it signs its records with from it.
+    "required": ["KEK"]
   },
   // The app's database, as the vault's own login: `wrangler hyperdrive
   // create coffre-vault --caching-disabled --connection-string=<vault login

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "The coffre command line: secrets in your shell, and `coffre init` for a new deployment.",
   "license": "MIT",
   "repository": {
@@ -23,13 +23,16 @@
   },
   "devDependencies": {
     "@types/node": "26.1.1",
+    "@types/pg": "8.20.0",
+    "pg": "8.16.3",
     "tsdown": "0.23.0",
     "typescript": "5.9.3",
-    "@coffre/client": "0.1.0",
-    "@coffre/core": "0.1.0"
+    "@coffre/client": "0.1.2",
+    "@coffre/core": "0.1.2",
+    "@coffre/db": "0.1.2"
   },
   "scripts": {
-    "build": "tsdown && node scripts/copy-templates.ts",
+    "build": "tsdown && node scripts/copy-templates.ts && node scripts/copy-migrations.ts",
     "typecheck": "tsc --noEmit",
     "test": "node --conditions=coffre:source --test"
   }