Module secrets 

Secrets on a VM and on a Docker host. The generated set-up never holds a value: it waits for the runner (Isothrum’s isothrum up) to deliver them over the machine’s own connection (SSH), then puts each file in place. Delivery writes a root-only copy of each value under KEPT_DIR (it outlives a reboot, which empties /run/secrets) and the mark DELIVERED the set-up waits for.

The order is the plan’s Secrets step: after the machine’s files, before what may read a secret (its provision steps, its before steps and its command). The set-up runs inside the target’s own tool (vagrant up, terraform apply, cloud-init), so the step is a gate: it waits for the mark, and the runner delivers while the tool runs.

Modules

windows

Secrets on a Windows VM, in PowerShell. Delivery keeps each value under KEPT_DIR, a folder only SYSTEM and Administrators can open, and leaves the mark DELIVERED the set-up waits for; each file is then written at its path with the same two readers and nobody else.

Constants

DELIVERED

The mark delivery leaves once every secret is kept.

DELIVERY_TIMEOUT

Seconds the set-up waits for the runner to deliver the secrets.

KEPT_DIR

Where a machine keeps the secrets delivered to it: root-only, on disk.

PLACE_SERVICE

The boot service putting the secrets back in place (/run is emptied at every boot). Its name sorts before before and command, the order OpenRC runs /etc/local.d in.

REACH_DIR

Where a Terraform set-up that waits for its secrets says how to reach its machine, under its module: one file per machine, <user>@<address>. The runner reads it while Terraform runs (the module’s outputs come only once every set-up is done) and delivers there.

Functions

compose_variable

The variable the Compose file reads secret name from: an input’s file, the input’s own variable; a secret, ISOLOOM_SECRET_<NAME>.

from_environment

A VM’s Secrets step when the tool that runs it hands the values over itself (Vagrant’s provisioner environment, filled from the host’s when Vagrant runs): each of values, a secret’s name and the variable holding its value in base64 (so a $, a quote or a line break in it is never read by the shell that sets the variable), kept as delivery keeps it and the delivery marked; then the files put in place now and at every boot. Nothing waits: the values are there. An empty or unset variable writes an empty value the first time, and keeps the value already kept after (a re-provision given no value again).

host_environment

On a Docker host, before docker compose up: the wait, then each secret of names in the variable the Compose file reads it from (compose_variable), its last line breaks kept. Nothing when there are none.

of_containers

The secrets a Docker host gets: those its containers get, in the order the spec declares them.

place

Each kept secret copied to its path, with its owner and mode (root and VM_DEFAULT_MODE unless the spec says), its folder made when missing.

receive

The script the runner runs as root on the machine. Its standard input holds one line per secret of names, in that order, each value in base64 (so any text fits on one line); the script keeps each one, marks the delivery, then puts files in place (so a run again refreshes them). Nothing of a value reaches its command line or its output.

step

A VM’s Secrets step: the wait, then its files put in place now and at every boot.

wait

Waits for the delivery mark, saying so once; fails after DELIVERY_TIMEOUT seconds with what to do. who names the machine in the messages.