├── .gitignore ├── LICENSE.md ├── Makefile ├── README.md ├── bundle.go ├── bundle_test.go ├── cmds └── coffer │ └── main.go ├── coffer.go ├── container.go ├── fake_kms_test.go ├── fake_s3_test.go ├── files.go ├── glide.lock ├── glide.yaml ├── kms.go ├── kms_test.go ├── nacl ├── secretbox.go └── secretbox_test.go ├── s3.go └── s3_test.go /.gitignore: -------------------------------------------------------------------------------- 1 | testcoffer 2 | build 3 | release 4 | *.coffer 5 | testcoffer.yaml 6 | dist 7 | build 8 | vendor 9 | -------------------------------------------------------------------------------- /LICENSE.md: -------------------------------------------------------------------------------- 1 | Copyright (c) 2015 Mark Wolfe 2 | 3 | Permission is hereby granted, free of charge, to any person 4 | obtaining a copy of this software and associated documentation 5 | files (the "Software"), to deal in the Software without 6 | restriction, including without limitation the rights to use, 7 | copy, modify, merge, publish, distribute, sublicense, and/or sell 8 | copies of the Software, and to permit persons to whom the 9 | Software is furnished to do so, subject to the following 10 | conditions: 11 | 12 | The above copyright notice and this permission notice shall be 13 | included in all copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 16 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES 17 | OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 18 | NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT 19 | HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, 20 | WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 21 | FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR 22 | OTHER DEALINGS IN THE SOFTWARE. 23 | -------------------------------------------------------------------------------- /Makefile: -------------------------------------------------------------------------------- 1 | NAME=coffer 2 | ARCH=$(shell uname -m) 3 | VERSION=2.1.0 4 | ITERATION := 1 5 | 6 | default: deps compile 7 | 8 | deps: 9 | go get github.com/c4milo/github-release 10 | go get github.com/mitchellh/gox 11 | glide install 12 | 13 | compile: deps 14 | @rm -rf build/ 15 | @gox -ldflags "-X main.Version=$(VERSION)" \ 16 | -osarch="darwin/amd64" \ 17 | -osarch="linux/i386" \ 18 | -osarch="linux/amd64" \ 19 | -osarch="windows/amd64" \ 20 | -osarch="windows/i386" \ 21 | -output "build/{{.Dir}}_$(VERSION)_{{.OS}}_{{.Arch}}/$(NAME)" \ 22 | $(shell glide novendor) 23 | 24 | dist: 25 | $(eval FILES := $(shell ls build)) 26 | @rm -rf dist && mkdir dist 27 | @for f in $(FILES); do \ 28 | (cd $(shell pwd)/build/$$f && tar -cvzf ../../dist/$$f.tar.gz *); \ 29 | (cd $(shell pwd)/dist && shasum -a 512 $$f.tar.gz > $$f.sha512); \ 30 | echo $$f; \ 31 | done 32 | 33 | release: 34 | @github-release "v$(VERSION)" dist/* --commit "$(git rev-parse HEAD)" --github-repository wolfeidau/$(NAME) 35 | 36 | test: deps 37 | go test -cover -v $(shell glide novendor) 38 | 39 | clean: 40 | @rm -rf dist build 41 | 42 | .PHONY: default deps clean compile dist release test -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # coffer 2 | 3 | This command line tool is designed to simplify storage and retrieval of secrets in [Amazon Web Services](https://aws.amazon.com). 4 | 5 | It uses the following services: 6 | 7 | * [Simple Storage Service](https://aws.amazon.com/s3/) (S3) to store secrets encrypted in files 8 | * [Key Management Service](https://aws.amazon.com/kms/) (KMS) to manage encryption keys which encrypt/decrypt your secrets 9 | 10 | A typical use case for coffer is you have a docker container which needs to retrieve on startup some file based secrets and apply them prior to starting a service. This is quite common requirement with continuous integration agents running in docker containers. 11 | 12 | # coffer bundle format 13 | 14 | coffer uses a a YAML file file to package a bunch of files together. The format of this file is illustrated below. 15 | 16 | coffer has the ability to synchronise the files described in this bundle with the filesystem, creating/updating and changing the mode of the files. 17 | 18 | ```yaml 19 | files: 20 | "/home/user/myfile2" : 21 | mode: 0755 22 | content: | 23 | # this is my file 24 | # with content 25 | ``` 26 | 27 | # environment 28 | 29 | The command reads the following environment variables. 30 | 31 | * `AWS_REGION` the AWS region 32 | * `AWS_PROFILE` the AWS profile to use 33 | * `COFFER_ALIAS` the alias name of the file in KMS 34 | * `S3_BUCKET` the S3 bucket which the file will be uploaded 35 | 36 | # usage 37 | 38 | Sub commands for this tool are: 39 | 40 | * encrypt, this encrypts the coffer file. 41 | * decrypt, this decrypts the coffer file, required at the moment if you want to edit it. 42 | * upload, uploads the coffer to s3, ensuring that only encrypted data gets uploaded. 43 | * download, pull down a coffer and validates it, file is only saved if it is decrypts and is valid. 44 | * sync, sync a coffer with the file system, this creates/modifies/chmods files based on the information in the yaml. 45 | 46 | # example 47 | 48 | Before you start. 49 | 50 | * Create a bucket in S3, I suggest something like `XXXX-coffers` in the same region as your KMS key. 51 | * Create a KMS key see [Creating Keys](http://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html) with the alias `coffer`, note this needs to be in the same region as your S3 bucket. 52 | * Make an IAM role in AWS for your servers permitting access to the S3 bucket and KMS key (see the IAM policy below). 53 | 54 | Create a coffer file with some SSH keys in it. 55 | 56 | ``` 57 | cat > buildkite.coffer <