confguard 4.0.1

Guard your sensitive configuration files
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

// src/sops/crypto.rs
use crate::errors::{ConfGuardError, ConfGuardResult};
use colored::Colorize;
use serde::Deserialize;
use std::io::Write;
use std::path::{Path, PathBuf};
use std::process::Command;
use std::{io, thread};
use tracing::debug;

#[derive(Debug, Clone, Deserialize)]
pub struct SopsCrypto {
    gpg_key: String,
}

impl SopsCrypto {
    pub fn new(gpg_key: String) -> Self {
        Self { gpg_key }
    }

    pub fn encrypt_file(&self, input: &Path, output: &Path) -> ConfGuardResult<()> {
        debug!(
            "{:?} Encrypting file: {:?} -> {:?}",
            thread::current().id(),
            input,
            output
        );

        let output = Command::new("sops")
            .arg("-e")
            .arg("--pgp")
            .arg(&self.gpg_key)
            .arg("--output")
            .arg(output)
            .arg(input) // the input file is the last argument
            .output()?;

        if !output.status.success() {
            eprintln!(
                "{}",
                format!(
                    "{:?}: sops failed: {:?}. Code: {:?}",
                    thread::current().id(),
                    input,
                    output.status.code()
                )
                .red()
            );
        }

        // Print stdout and stderr
        io::stdout().write_all(&output.stdout)?;
        io::stderr().write_all(&output.stderr)?;

        Ok(())
    }

    pub fn decrypt_file(&self, input: &Path, output: &Path) -> ConfGuardResult<()> {
        debug!(
            "{:?} Decrypting file: {:?} -> {:?}",
            thread::current().id(),
            input,
            output
        );

        let output = if output.extension().unwrap_or_default() == "env" {
            debug!("Decrypt dotenv {:?} -> {:?}", input, output);
            Command::new("sops")
                .arg("-d")
                .arg("--pgp")
                .arg(&self.gpg_key)
                .arg("--input-type")
                .arg("dotenv")
                .arg("--output-type")
                .arg("dotenv")
                .arg("--output")
                .arg(output)
                .arg(input) // the input file is the last argument
                .output()?
        } else {
            debug!("Decrypt dotenv {:?} -> {:?}", input, output);
            Command::new("sops")
                .arg("-d")
                .arg("--pgp")
                .arg(&self.gpg_key)
                .arg("--output")
                .arg(output)
                .arg(input) // the input file is the last argument
                .output()?
        };

        if !output.status.success() {
            eprintln!(
                "{}",
                format!(
                    "{:?}: sops failed: {:?}. Code: {:?}",
                    thread::current().id(),
                    input,
                    output.status.code()
                )
                .red()
            );
        }

        // Print stdout and stderr
        io::stdout().write_all(&output.stdout)?;
        io::stderr().write_all(&output.stderr)?;

        Ok(())
    }
}