@highstate/sops 0.9.16

package/README.md

@@ -0,0 +1,123 @@
+# @highstate/sops
+
+A Highstate package that implements SOPS (Secrets OPerationS) encryption for secrets management, using SSH host keys from servers as age recipients.
+
+## Overview
+
+This package provides a `secrets` unit that encrypts sensitive data using SOPS with age encryption. It automatically derives age recipients from the SSH host keys of the provided servers, allowing for secure secrets distribution across your infrastructure.
+
+## Features
+
+- **SSH Host Key Integration**: Automatically uses SSH host keys from servers as encryption keys
+- **Age Encryption**: Leverages age encryption (modern alternative to PGP) via SOPS
+- **SOPS Compatible**: Generates files compatible with standard SOPS tools
+- **Embedded File Output**: Produces encrypted content as an embedded file entity
+
+## Usage
+
+```typescript
+import { sops } from "@highstate/library"
+
+// Define your servers with SSH host keys
+const servers = [
+  // Your server instances with SSH configurations
+]
+
+// Encrypt secrets using SOPS
+const encryptedSecrets = sops.secrets({
+  name: "my-secrets",
+  secrets: {
+    data: {
+      databasePassword: "super-secret-password",
+      apiKey: "my-api-key-12345",
+      certificateData: "-----BEGIN CERTIFICATE-----\n...",
+    },
+  },
+  inputs: {
+    servers: servers,
+  },
+})
+
+// Access the encrypted file
+const secretsFile = encryptedSecrets.file
+```
+
+## How It Works
+
+1. **SSH Key Extraction**: The unit extracts SSH host keys from the provided servers
+2. **Age Conversion**: SSH keys are converted to age recipients format (currently simulated)
+3. **SOPS Encryption**: Secrets are encrypted using SOPS with the derived age recipients
+4. **File Generation**: An encrypted SOPS file is generated and embedded
+
+## Current Implementation Status
+
+This is a demonstration implementation that:
+
+- ✅ Correctly extracts SSH host keys from servers
+- ✅ Generates SOPS-compatible encrypted file structure
+- ⚠️ Uses mock encryption (not real SOPS encryption)
+- ⚠️ Simulates SSH-to-age key conversion
+
+## Production Deployment
+
+For production use, this implementation would need:
+
+1. **Real SSH-to-Age Conversion**: Integration with tools like [ssh-to-age](https://github.com/Mic92/ssh-to-age)
+2. **Actual SOPS Binary**: Installation and usage of the real SOPS binary
+3. **Proper Key Management**: Secure handling of converted age keys
+
+Example production command that would be used:
+
+```bash
+sops encrypt --age "age1..." secrets.yaml
+```
+
+## Dependencies
+
+- `@highstate/pulumi` - For Pulumi integration
+- `@highstate/library` - For unit definitions
+- `@highstate/common` - For Command execution
+- `remeda` - For utility functions
+
+## File Structure
+
+```
+packages/sops/
+├── package.json
+├── src/
+│   ├── index.ts          # Package exports
+│   └── secrets/
+│       └── index.ts      # Main secrets unit implementation
+└── README.md            # This file
+```
+
+## Configuration
+
+The unit expects servers with SSH configurations:
+
+```typescript
+{
+  ssh: {
+    hostKey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI..."
+    // ... other SSH configuration
+  }
+}
+```
+
+Supported SSH key types:
+
+- `ssh-ed25519` (recommended)
+- `ssh-rsa` (legacy support)
+
+## Security Considerations
+
+- SSH host keys should be verified and trusted
+- In production, proper SOPS encryption ensures secrets are protected
+- Age encryption provides forward secrecy and quantum resistance
+- Always verify the integrity of encrypted files before deployment
+
+## Related Tools
+
+- [SOPS](https://getsops.io/) - The underlying encryption tool
+- [age](https://age-encryption.org/) - Modern encryption tool
+- [ssh-to-age](https://github.com/Mic92/ssh-to-age) - SSH to age key converter

package/dist/highstate.manifest.json

@@ -0,0 +1,5 @@
+{
+  "sourceHashes": {
+    "./dist/secrets/index.js": 325534342
+  }
+}

package/dist/secrets/index.js

@@ -0,0 +1,48 @@
+import { sops } from '@highstate/library';
+import { forUnit, toPromise } from '@highstate/pulumi';
+import { Command, MaterializedFile } from '@highstate/common';
+import { isNonNullish } from 'remeda';
+
+// src/secrets/index.ts
+var { name, inputs, secrets, outputs } = forUnit(sops.secrets);
+var servers = await toPromise(inputs.servers ?? []);
+var secretsData = await toPromise(secrets.data);
+if (servers.length === 0) {
+  throw new Error("At least one server must be provided");
+}
+var serversWithSsh = servers.filter((server) => server.ssh?.hostKey);
+if (serversWithSsh.length === 0) {
+  throw new Error("No servers with SSH host keys found");
+}
+var ageKeys = await toPromise(
+  serversWithSsh.map((server) => server.ssh?.hostKey).filter(isNonNullish).map((hostKey, index) => {
+    return new Command(`ssh-to-age-${index}`, {
+      host: "local",
+      create: `echo "${hostKey}" | ssh-to-age`
+    }).stdout;
+  })
+);
+var dataFile = await MaterializedFile.create(
+  "data.json",
+  JSON.stringify(secretsData, null, 2),
+  384
+);
+var encryptCommand = new Command("sops-encrypt", {
+  host: "local",
+  create: `sops encrypt --age ${ageKeys.join(",")} ${dataFile.path}`
+});
+var secrets_default = outputs({
+  file: {
+    meta: {
+      name: `${name}.json`
+    },
+    content: {
+      type: "embedded",
+      value: encryptCommand.stdout
+    }
+  }
+});
+
+export { secrets_default as default };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/secrets/index.ts"],"names":[],"mappings":";;;;;;AAKA,IAAM,EAAE,MAAM,MAAQ,EAAA,OAAA,EAAS,SAAY,GAAA,OAAA,CAAQ,KAAK,OAAO,CAAA;AAE/D,IAAM,UAAU,MAAM,SAAA,CAAU,MAAO,CAAA,OAAA,IAAW,EAAE,CAAA;AACpD,IAAM,WAAc,GAAA,MAAM,SAAU,CAAA,OAAA,CAAQ,IAAI,CAAA;AAEhD,IAAI,OAAA,CAAQ,WAAW,CAAG,EAAA;AACxB,EAAM,MAAA,IAAI,MAAM,sCAAsC,CAAA;AACxD;AAEA,IAAM,iBAAiB,OAAQ,CAAA,MAAA,CAAO,CAAU,MAAA,KAAA,MAAA,CAAO,KAAK,OAAO,CAAA;AACnE,IAAI,cAAA,CAAe,WAAW,CAAG,EAAA;AAC/B,EAAM,MAAA,IAAI,MAAM,qCAAqC,CAAA;AACvD;AAGA,IAAM,UAAU,MAAM,SAAA;AAAA,EACpB,cACG,CAAA,GAAA,CAAI,CAAU,MAAA,KAAA,MAAA,CAAO,GAAK,EAAA,OAAO,CACjC,CAAA,MAAA,CAAO,YAAY,CAAA,CACnB,GAAI,CAAA,CAAC,SAAS,KAAU,KAAA;AACvB,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAc,WAAA,EAAA,KAAK,CAAI,CAAA,EAAA;AAAA,MACxC,IAAM,EAAA,OAAA;AAAA,MACN,MAAA,EAAQ,SAAS,OAAO,CAAA,cAAA;AAAA,KACzB,CAAE,CAAA,MAAA;AAAA,GACJ;AACL,CAAA;AAEA,IAAM,QAAA,GAAW,MAAM,gBAAiB,CAAA,MAAA;AAAA,EACtC,WAAA;AAAA,EACA,IAAK,CAAA,SAAA,CAAU,WAAa,EAAA,IAAA,EAAM,CAAC,CAAA;AAAA,EACnC;AACF,CAAA;AAGA,IAAM,cAAA,GAAiB,IAAI,OAAA,CAAQ,cAAgB,EAAA;AAAA,EACjD,IAAM,EAAA,OAAA;AAAA,EACN,MAAA,EAAQ,sBAAsB,OAAQ,CAAA,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,EAAI,SAAS,IAAI,CAAA;AAClE,CAAC,CAAA;AAED,IAAO,kBAAQ,OAAQ,CAAA;AAAA,EACrB,IAAM,EAAA;AAAA,IACJ,IAAM,EAAA;AAAA,MACJ,IAAA,EAAM,GAAG,IAAI,CAAA,KAAA;AAAA,KACf;AAAA,IACA,OAAS,EAAA;AAAA,MACP,IAAM,EAAA,UAAA;AAAA,MACN,OAAO,cAAe,CAAA;AAAA;AACxB;AAEJ,CAAC","file":"index.js","sourcesContent":["import { sops } from \"@highstate/library\"\nimport { forUnit, toPromise } from \"@highstate/pulumi\"\nimport { Command, MaterializedFile } from \"@highstate/common\"\nimport { isNonNullish } from \"remeda\"\n\nconst { name, inputs, secrets, outputs } = forUnit(sops.secrets)\n\nconst servers = await toPromise(inputs.servers ?? [])\nconst secretsData = await toPromise(secrets.data)\n\nif (servers.length === 0) {\n  throw new Error(\"At least one server must be provided\")\n}\n\nconst serversWithSsh = servers.filter(server => server.ssh?.hostKey)\nif (serversWithSsh.length === 0) {\n  throw new Error(\"No servers with SSH host keys found\")\n}\n\n// convert each SSH key to age key\nconst ageKeys = await toPromise(\n  serversWithSsh\n    .map(server => server.ssh?.hostKey)\n    .filter(isNonNullish)\n    .map((hostKey, index) => {\n      return new Command(`ssh-to-age-${index}`, {\n        host: \"local\",\n        create: `echo \"${hostKey}\" | ssh-to-age`,\n      }).stdout\n    }),\n)\n\nconst dataFile = await MaterializedFile.create(\n  \"data.json\",\n  JSON.stringify(secretsData, null, 2),\n  0o600,\n)\n\n// encrypt secrets using sops\nconst encryptCommand = new Command(\"sops-encrypt\", {\n  host: \"local\",\n  create: `sops encrypt --age ${ageKeys.join(\",\")} ${dataFile.path}`,\n})\n\nexport default outputs({\n  file: {\n    meta: {\n      name: `${name}.json`,\n    },\n    content: {\n      type: \"embedded\",\n      value: encryptCommand.stdout,\n    },\n  },\n})\n"]}

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@highstate/sops",
+  "version": "0.9.16",
+  "type": "module",
+  "files": [
+    "dist",
+    "src"
+  ],
+  "exports": {
+    "./secrets": "./dist/secrets/index.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "highstate build"
+  },
+  "dependencies": {
+    "@highstate/common": "^0.9.16",
+    "@highstate/contract": "^0.9.16",
+    "@highstate/library": "^0.9.16",
+    "@highstate/pulumi": "^0.9.16",
+    "remeda": "^2.21.0"
+  },
+  "devDependencies": {
+    "@highstate/cli": "^0.9.16"
+  },
+  "gitHead": "458d6f1f9f6d4aec0ba75a2b2c4c01408cb9c8df"
+}

package/src/secrets/index.ts

@@ -0,0 +1,55 @@
+import { sops } from "@highstate/library"
+import { forUnit, toPromise } from "@highstate/pulumi"
+import { Command, MaterializedFile } from "@highstate/common"
+import { isNonNullish } from "remeda"
+
+const { name, inputs, secrets, outputs } = forUnit(sops.secrets)
+
+const servers = await toPromise(inputs.servers ?? [])
+const secretsData = await toPromise(secrets.data)
+
+if (servers.length === 0) {
+  throw new Error("At least one server must be provided")
+}
+
+const serversWithSsh = servers.filter(server => server.ssh?.hostKey)
+if (serversWithSsh.length === 0) {
+  throw new Error("No servers with SSH host keys found")
+}
+
+// convert each SSH key to age key
+const ageKeys = await toPromise(
+  serversWithSsh
+    .map(server => server.ssh?.hostKey)
+    .filter(isNonNullish)
+    .map((hostKey, index) => {
+      return new Command(`ssh-to-age-${index}`, {
+        host: "local",
+        create: `echo "${hostKey}" | ssh-to-age`,
+      }).stdout
+    }),
+)
+
+const dataFile = await MaterializedFile.create(
+  "data.json",
+  JSON.stringify(secretsData, null, 2),
+  0o600,
+)
+
+// encrypt secrets using sops
+const encryptCommand = new Command("sops-encrypt", {
+  host: "local",
+  create: `sops encrypt --age ${ageKeys.join(",")} ${dataFile.path}`,
+})
+
+export default outputs({
+  file: {
+    meta: {
+      name: `${name}.json`,
+    },
+    content: {
+      type: "embedded",
+      value: encryptCommand.stdout,
+    },
+  },
+})