signet_client/
lib.rs

1//! Rust client for [signet](https://github.com/bytepunx/signet).
2//!
3//! Two connection modes mirror the two listeners signet exposes:
4//!   - [`dial_workload`](client::dial_workload) connects to the workload-facing
5//!     `SecretsService` using SPIFFE mTLS, the same credential mechanism the
6//!     signet server itself uses to authenticate callers. Gated behind the
7//!     `spiffe-workload` feature — see the crate README for why, and for the
8//!     fallback path (bring your own `tonic::transport::Channel`) when it's
9//!     disabled.
10//!   - [`dial_admin`](client::dial_admin) connects to the operator-facing
11//!     `AdminService`/`GitOpsService` using a bearer token over TLS (or
12//!     plaintext for loopback addresses), mirroring signet's own `signet`
13//!     CLI.
14//!
15//! [`watch_bundle`](restart::watch_bundle), [`acquire_lock`](restart::acquire_lock),
16//! and [`wait_for_restart`](restart::wait_for_restart) implement signet's
17//! coordinated-restart protocol: a service can watch for its own bundle
18//! changes and safely serialize a fleet-wide restart via signet's distributed
19//! restart lock, without a process host and without ever writing secrets to
20//! the environment or disk. See `README.md`'s "Coordinated restarts" section
21//! for the full design rationale, mirrored from the Go client.
22//!
23//! [`encrypt_for_secret`](sops_encrypt::encrypt_for_secret) produces
24//! SOPS-compatible encrypted ciphertext for a secret value, since signetd
25//! never encrypts on a client's behalf (`SyncBundle`/`TriggerSync` require
26//! content already be real SOPS ciphertext). Mirrors `go/sops_encrypt.go`.
27
28pub mod client;
29pub mod restart;
30pub mod sops_encrypt;
31
32/// Generated protobuf/tonic bindings for signet, from bytepunx/signet-proto.
33/// Run `buf generate` to regenerate `src/gen`.
34// Each base file ends with its own `include!` of the matching *.tonic.rs
35// file, so only the base file needs including here.
36pub mod signet {
37    pub mod v1 {
38        include!("gen/signet/v1/signet.v1.rs");
39    }
40}
41
42pub mod admin {
43    pub mod v1 {
44        include!("gen/admin/v1/admin.v1.rs");
45    }
46}
47
48pub use client::{
49    admin_client, dial_admin, gitops_client, read_ca_file, AdminChannel, ClientError,
50    TokenInterceptor,
51};
52#[cfg(feature = "spiffe-workload")]
53pub use client::dial_workload;
54pub use restart::{acquire_lock, wait_for_restart, watch_bundle, Lock, RestartError};
55pub use sops_encrypt::{encrypt_for_secret, SopsEncryptError};
signet_client/lib.rs

signet_client/
lib.rs
