Add OpenBao-backed secret storage (backend) - #272
Conversation
| .mount_auth_endpoint(update_workspace_info, state, allowed_client_type) | ||
| .mount_auth_endpoint(update_workspace_info, state, allowed_client_type); | ||
|
|
||
| #[cfg(feature = "cloud")] |
There was a problem hiding this comment.
Mount secrets regardless of the mode we're running in. Self hosted will get it as well
There was a problem hiding this comment.
I thought we were limiting secrets to cloud only?
There was a problem hiding this comment.
There's two different types of self hosted:
- You run the API directly on a server (not fully built yet, but is the future of self hosted)
- The runner exposes a UI that acts as the self hosted (older, depreciated, unsupported. Will be removed)
I meant that we're doing cloud only in the sense that there will be no 2. We can add it to the code like we normally would, but since 1 isn't fully built yet, there's no way to currently deploy this anywhere. We'll build it into the API nevertheless, with the intention of 1 being in place in the near future.
#234 was the one that introduced 1. Removal of 2 will be in a future PR
There was a problem hiding this comment.
Each route gets a separate file, like the others. Don't put them all in one file like this
There was a problem hiding this comment.
Either:
- Find a library that does this for us
- If not, inline these things. Not complex enough to warrant a separate client
- re-enable the workspace secret module and implement the create/update/delete/list handlers - store secret values in OpenBao (KV v2) with only references in Postgres; zeroize plaintext on write - add OpenBaoClient and a cloud-only OpenBaoConfig, with a startup connectivity check - add an OpenBao service to the devcontainer compose - regenerate .sqlx and the frontend TS bindings
7bbc48d to
0809136
Compare
2 participants
Summary
secretmodule and implements the create/update/delete/list handlers: values are written to OpenBao (KV v2), Postgres stores only references, and the plaintext is zeroized after the write.OpenBaoClientand a cloud-onlyOpenBaoConfig, with a startup connectivity check; the whole feature is cloud-gated..sqlxand the frontend TS bindings.This is the backend slice; the runner resolve path and the frontend UI land in follow-up PRs.
Test plan
cargo check -p api(cloud) andcargo check -p api --no-default-features(self-hosted) both compile;cargo bindingsandjust prepareare clean.secret/data/{workspace}/{secret}, Postgres row holds only metadata (no value column).404+ row gone).By opening this pull request, I confirm that I have read and agreed to the terms in CONTRIBUTING.md, and that I am legally allowed to submit this code under those terms.
🤖 Generated with Claude Code