@coffre/cli 0.1.1 → 0.1.2

package/dist/templates/node/src/vault.ts

@@ -15,10 +15,12 @@ const vault = await serveVault({
   socket: env('VAULT_SOCKET'),
   database: env('DATABASE_URL'),
   kek: { id: env('KEK_ID'), key: env('KEK') },
-  // After a rotation, the KEKs before it, so the data keys they wrapped
-  // still open: previousKeks: [{ id: 'kek-1', key: env('KEK_1') }],
+  // After a rotation, the KEKs before it, so the data keys they wrapped still
+  // open and the records signed under them before it still verify:
+  // previousKeks: [{ id: 'kek-1', key: env('KEK_1') }],
   rootAdmins: env('ROOT_ADMINS').split(',').map((email) => email.trim()),
-  signingKey: env('SIGNING_KEY'),
+  // The vault derives its signing key from the KEK. With a KEK a key service
+  // holds, such as awsKms(…), it needs one of its own: signingKey: env('SIGNING_KEY').
 });
 console.log(`the vault is listening on ${vault.socket}`);
 

package/dist/templates/node/vault.env.example

@@ -2,15 +2,14 @@
 # the vault's user alone.
 
 VAULT_SOCKET=vault.sock
-# The server's Postgres database, as the vault's own login.
+# From `coffre setup`: the server's database, as the vault's own login.
 DATABASE_URL=postgres://coffre_vault_runtime:CHANGE_ME@127.0.0.1:5432/coffre
 
-# From `coffre keys`, saved in your password manager first.
-# The key-encryption key, and its name. A rotation gives the new one a new name.
+# From `coffre setup`, saved in your password manager first: the
+# key-encryption key, and its name. A rotation gives the new one a new name.
+# The vault derives the key it signs its records with from it.
 KEK_ID=kek-1
 KEK=
-# Signs the vault's log entries, checkpoints and member rows.
-SIGNING_KEY=
 
 # Comma-separated emails: the first people in, whom nobody can remove.
 ROOT_ADMINS=you@example.com

package/dist/templates/workers/README.md

@@ -17,76 +17,61 @@ Worker secrets. Everything below runs from this directory.
 - `app/wrangler.jsonc`: `PUBLIC_URL`, and `GITHUB_CLIENT_ID` from a GitHub
   OAuth app whose callback is `<PUBLIC_URL>/auth/callback/github`.
 - `vault/wrangler.jsonc`: `ROOT_ADMINS`, the emails of the first people in,
-  and `KEK_ID`, which `coffre keys` gives you below.
+  and `KEK_ID`, which `coffre setup` gives you below.
 
-## 2. The database
+## 2. The database and keys
 
-coffre wants a Postgres database with three logins: its owner, for
-migrations; `coffre_runtime`, which the app runs as; and
-`coffre_vault_runtime`, which the vault runs as. Create the two as plain
-logins. As the database's administrator, connect with `psql` and run:
-
-```sql
-CREATE ROLE coffre_runtime LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
-CREATE ROLE coffre_vault_runtime LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
-\password coffre_runtime
-\password coffre_vault_runtime
-```
-
-Each `\password` prompts for a different generated password. The owner
-must be able to create and grant roles: the migration creates `coffre_app`
-and `coffre_vault`, and grants each login its own group. Only the vault may
-write members and grants, and each appends to the log only as itself.
-URL-encode special characters in the passwords in these URLs:
+Make a Postgres database, then, from this directory:
 
 ```sh
-pnpm install
-pnpm migrate "postgres://owner:…@db.example.com:5432/coffre"
-pnpm exec wrangler hyperdrive create coffre --caching-disabled \
-  --connection-string="postgres://coffre_runtime:…@db.example.com:5432/coffre"
-pnpm exec wrangler hyperdrive create coffre-vault --caching-disabled \
-  --connection-string="postgres://coffre_vault_runtime:…@db.example.com:5432/coffre"
+npx @coffre/cli setup
 ```
 
-Keep `--caching-disabled`: Hyperdrive otherwise caches reads for up to a
-minute, and a revoked token or a signed-out session could keep working that
-long. `wrangler.jsonc` cannot set it, so for a config made another way,
-check `caching` in `wrangler hyperdrive get <id>`.
+Run it with the CLI you ran `coffre init` with. It asks for the database
+administrator's connection string at a hidden prompt (a script can pipe it
+in, or set `COFFRE_SETUP_DATABASE_URL`; never pass it as an argument). It
+makes the two logins coffre runs as, `coffre_runtime` for the app and
+`coffre_vault_runtime` for the vault, migrates the database, checks that
+each login holds only its rights, and prints every value at once: the two
+keys, the KEK's id, and each login's connection string. It keeps no copy and
+writes no file. Save its output in your password manager, with the GitHub
+client secret, before anything else. There is one key for each Worker, so
+that the app, which faces the network, never holds what decrypts a value:
+
+- `KEK`, the vault's, decrypts every value, and the vault derives from it the
+  key it signs its records with. Lose it, and every value is lost.
+- `AUDIT_CHAIN_KEY`, the app's, signs the app's log entries, sessions and
+  tokens. Lose it, and everyone is signed out and the log stops verifying.
+
+To do the same by hand, see
+[deploy.md](https://github.com/erwinkn/coffre/blob/main/docs/deploy.md#appendix-the-database-by-hand).
+
+## 3. Hyperdrive and secrets
+
+Run the two `wrangler hyperdrive create` commands setup printed: one config
+per login, each `--caching-disabled`. Hyperdrive otherwise caches reads for
+up to a minute, and a revoked token or a signed-out session could keep
+working that long. `wrangler.jsonc` cannot set it, so for a config made
+another way, check `caching` in `wrangler hyperdrive get <id>`.
 
 Put the ids they print under `hyperdrive`, the first in
-`app/wrangler.jsonc` and the second in `vault/wrangler.jsonc`. Run
-`pnpm migrate` again after every upgrade of `@coffre/server`, before
-deploying it.
-
-## 3. Keys
-
-```sh
-coffre keys
-```
-
-Run it with the CLI you ran `coffre init` with, or as
-`npx @coffre/cli keys`. It prints three keys and the KEK's id, once, and
-keeps no copy. Save its output in your password manager, with the GitHub
-client secret, before anything else. The vault gets `KEK` and `SIGNING_KEY`,
-and the app `AUDIT_CHAIN_KEY`, so that the app, which faces the network,
-never holds what decrypts a value:
-
-- `KEK` decrypts every value. Lose it, and every value is lost.
-- `SIGNING_KEY` signs the vault's log entries and member rows.
-- `AUDIT_CHAIN_KEY` signs the app's log entries, sessions and tokens.
-
-Lose either of the last two, and the log stops verifying and everyone is
-locked out. Put `KEK_ID` in `vault/wrangler.jsonc`, then set the secrets;
-each command prompts for the saved value:
+`app/wrangler.jsonc` and the second in `vault/wrangler.jsonc`, and `KEK_ID`
+in `vault/wrangler.jsonc`. Then set the secrets; each command prompts for
+the saved value:
 
 ```sh
 pnpm exec wrangler secret put KEK -c vault/wrangler.jsonc
-pnpm exec wrangler secret put SIGNING_KEY -c vault/wrangler.jsonc
 pnpm exec wrangler secret put AUDIT_CHAIN_KEY -c app/wrangler.jsonc
 pnpm exec wrangler secret put GITHUB_CLIENT_SECRET -c app/wrangler.jsonc
 ```
 
-Keep older KEKs after a rotation too: what they wrapped still needs them.
+Run `pnpm migrate`, with the administrator's URL in `DATABASE_URL`, after
+every upgrade of `@coffre/server`, before deploying it.
+
+Keep older KEKs after a rotation, for good: what they wrapped still needs
+them, and so does what the vault signed under them before it. With AWS KMS
+instead of a key of your own, the vault also needs a `SIGNING_KEY`
+([keys](https://github.com/erwinkn/coffre/blob/main/docs/keys.md#aws-kms)).
 
 ## 4. Deploy
 

package/dist/templates/workers/app/wrangler.jsonc

@@ -17,7 +17,7 @@
     "GITHUB_CLIENT_ID": "replace-with-your-client-id"
   },
   "secrets": {
-    // AUDIT_CHAIN_KEY is from `coffre keys`; the app never gets the vault's keys.
+    // AUDIT_CHAIN_KEY is from `coffre setup`; the app never gets the vault's keys.
     "required": ["GITHUB_CLIENT_SECRET", "AUDIT_CHAIN_KEY"]
   },
   // `wrangler hyperdrive create coffre --caching-disabled --connection-string=<runtime login URL>`

package/dist/templates/workers/package.json

@@ -14,13 +14,13 @@
     "conformance": "coffre-conformance workers"
   },
   "dependencies": {
-    "@coffre/server": "0.1.1",
-    "@coffre/ui": "0.1.1",
-    "@coffre/vault": "0.1.1"
+    "@coffre/server": "0.1.2",
+    "@coffre/ui": "0.1.2",
+    "@coffre/vault": "0.1.2"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "5.20260920.1",
-    "@coffre/conformance": "0.1.1",
+    "@coffre/conformance": "0.1.2",
     "typescript": "5.9.3",
     "wrangler": "4.118.0"
   }

package/dist/templates/workers/vault/src/worker.ts

@@ -7,15 +7,16 @@ type Env = {
   VAULT_HYPERDRIVE: Hyperdrive;
   KEK_ID: string;
   KEK: string;
-  SIGNING_KEY: string;
   ROOT_ADMINS: string;
 };
 
 export default vault((env: Env) => ({
   database: postgres(env.VAULT_HYPERDRIVE),
   kek: { id: env.KEK_ID, key: env.KEK },
-  // After a rotation, the KEKs before it, so the data keys they wrapped
-  // still open: previousKeks: [{ id: 'kek-2026-09', key: env.KEK_2026_09 }],
+  // After a rotation, the KEKs before it, so the data keys they wrapped still
+  // open and the records signed under them before it still verify:
+  // previousKeks: [{ id: 'kek-2026-09', key: env.KEK_2026_09 }],
   rootAdmins: env.ROOT_ADMINS.split(',').map((email) => email.trim()),
-  signingKey: env.SIGNING_KEY,
+  // The vault derives its signing key from the KEK. With a KEK a key service
+  // holds, such as awsKms(…), it needs one of its own: signingKey: env.SIGNING_KEY.
 }));

package/dist/templates/workers/vault/wrangler.jsonc

@@ -11,14 +11,15 @@
   "workers_dev": false,
   "observability": { "enabled": true },
   "vars": {
-    // Names the KEK below: from `coffre keys`. A rotation gives the new one a new id.
+    // Names the KEK below: from `coffre setup`. A rotation gives the new one a new id.
     "KEK_ID": "kek-1",
     // Comma-separated emails: the first people in, whom nobody can remove.
     "ROOT_ADMINS": "you@example.com"
   },
   "secrets": {
-    // From `coffre keys`: wrangler secret put KEK, then SIGNING_KEY.
-    "required": ["KEK", "SIGNING_KEY"]
+    // From `coffre setup`: wrangler secret put KEK. The vault derives the key
+    // it signs its records with from it.
+    "required": ["KEK"]
   },
   // The app's database, as the vault's own login: `wrangler hyperdrive
   // create coffre-vault --caching-disabled --connection-string=<vault login

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "The coffre command line: secrets in your shell, and `coffre init` for a new deployment.",
   "license": "MIT",
   "repository": {
@@ -23,13 +23,16 @@
   },
   "devDependencies": {
     "@types/node": "26.1.1",
+    "@types/pg": "8.20.0",
+    "pg": "8.16.3",
     "tsdown": "0.23.0",
     "typescript": "5.9.3",
-    "@coffre/core": "0.1.1",
-    "@coffre/client": "0.1.1"
+    "@coffre/client": "0.1.2",
+    "@coffre/core": "0.1.2",
+    "@coffre/db": "0.1.2"
   },
   "scripts": {
-    "build": "tsdown && node scripts/copy-templates.ts",
+    "build": "tsdown && node scripts/copy-templates.ts && node scripts/copy-migrations.ts",
     "typecheck": "tsc --noEmit",
     "test": "node --conditions=coffre:source --test"
   }