Separate web UI into standalone metacrypt-web binary
The vault server holds in-memory unsealed state (KEK, engine keys) that is lost on restart, requiring a full unseal ceremony. Previously the web UI ran inside the vault process, so any UI change forced a restart and re-unseal. This change extracts the web UI into a separate metacrypt-web binary that communicates with the vault over an authenticated gRPC connection. The web server carries no sealed state and can be restarted freely. - gen/metacrypt/v1/: generated Go bindings from proto/metacrypt/v1/ - internal/grpcserver/: full gRPC server implementation (System, Auth, Engine, PKI, Policy, ACME services) with seal/auth/admin interceptors - internal/webserver/: web server with gRPC vault client; templates embedded via web/embed.go (no runtime web/ directory needed) - cmd/metacrypt-web/: standalone binary entry point - internal/config: added [web] section (listen_addr, vault_grpc, etc.) - internal/server/routes.go: removed all web UI routes and handlers - cmd/metacrypt/server.go: starts gRPC server alongside HTTP server - Deploy: Dockerfile builds both binaries, docker-compose adds metacrypt-web service, new metacrypt-web.service systemd unit, Makefile gains proto/metacrypt-web targets Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
235
gen/metacrypt/v1/engine_grpc.pb.go
Normal file
235
gen/metacrypt/v1/engine_grpc.pb.go
Normal file
@@ -0,0 +1,235 @@
|
||||
// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
|
||||
// versions:
|
||||
// - protoc-gen-go-grpc v1.6.1
|
||||
// - protoc v3.20.3
|
||||
// source: metacrypt/v1/engine.proto
|
||||
|
||||
package metacryptv1
|
||||
|
||||
import (
|
||||
context "context"
|
||||
grpc "google.golang.org/grpc"
|
||||
codes "google.golang.org/grpc/codes"
|
||||
status "google.golang.org/grpc/status"
|
||||
)
|
||||
|
||||
// This is a compile-time assertion to ensure that this generated file
|
||||
// is compatible with the grpc package it is being compiled against.
|
||||
// Requires gRPC-Go v1.64.0 or later.
|
||||
const _ = grpc.SupportPackageIsVersion9
|
||||
|
||||
const (
|
||||
EngineService_Mount_FullMethodName = "/metacrypt.v1.EngineService/Mount"
|
||||
EngineService_Unmount_FullMethodName = "/metacrypt.v1.EngineService/Unmount"
|
||||
EngineService_ListMounts_FullMethodName = "/metacrypt.v1.EngineService/ListMounts"
|
||||
EngineService_Request_FullMethodName = "/metacrypt.v1.EngineService/Request"
|
||||
)
|
||||
|
||||
// EngineServiceClient is the client API for EngineService service.
|
||||
//
|
||||
// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
|
||||
type EngineServiceClient interface {
|
||||
Mount(ctx context.Context, in *MountRequest, opts ...grpc.CallOption) (*MountResponse, error)
|
||||
Unmount(ctx context.Context, in *UnmountRequest, opts ...grpc.CallOption) (*UnmountResponse, error)
|
||||
ListMounts(ctx context.Context, in *ListMountsRequest, opts ...grpc.CallOption) (*ListMountsResponse, error)
|
||||
Request(ctx context.Context, in *EngineRequest, opts ...grpc.CallOption) (*EngineResponse, error)
|
||||
}
|
||||
|
||||
type engineServiceClient struct {
|
||||
cc grpc.ClientConnInterface
|
||||
}
|
||||
|
||||
func NewEngineServiceClient(cc grpc.ClientConnInterface) EngineServiceClient {
|
||||
return &engineServiceClient{cc}
|
||||
}
|
||||
|
||||
func (c *engineServiceClient) Mount(ctx context.Context, in *MountRequest, opts ...grpc.CallOption) (*MountResponse, error) {
|
||||
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
|
||||
out := new(MountResponse)
|
||||
err := c.cc.Invoke(ctx, EngineService_Mount_FullMethodName, in, out, cOpts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
func (c *engineServiceClient) Unmount(ctx context.Context, in *UnmountRequest, opts ...grpc.CallOption) (*UnmountResponse, error) {
|
||||
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
|
||||
out := new(UnmountResponse)
|
||||
err := c.cc.Invoke(ctx, EngineService_Unmount_FullMethodName, in, out, cOpts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
func (c *engineServiceClient) ListMounts(ctx context.Context, in *ListMountsRequest, opts ...grpc.CallOption) (*ListMountsResponse, error) {
|
||||
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
|
||||
out := new(ListMountsResponse)
|
||||
err := c.cc.Invoke(ctx, EngineService_ListMounts_FullMethodName, in, out, cOpts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
func (c *engineServiceClient) Request(ctx context.Context, in *EngineRequest, opts ...grpc.CallOption) (*EngineResponse, error) {
|
||||
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
|
||||
out := new(EngineResponse)
|
||||
err := c.cc.Invoke(ctx, EngineService_Request_FullMethodName, in, out, cOpts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// EngineServiceServer is the server API for EngineService service.
|
||||
// All implementations must embed UnimplementedEngineServiceServer
|
||||
// for forward compatibility.
|
||||
type EngineServiceServer interface {
|
||||
Mount(context.Context, *MountRequest) (*MountResponse, error)
|
||||
Unmount(context.Context, *UnmountRequest) (*UnmountResponse, error)
|
||||
ListMounts(context.Context, *ListMountsRequest) (*ListMountsResponse, error)
|
||||
Request(context.Context, *EngineRequest) (*EngineResponse, error)
|
||||
mustEmbedUnimplementedEngineServiceServer()
|
||||
}
|
||||
|
||||
// UnimplementedEngineServiceServer must be embedded to have
|
||||
// forward compatible implementations.
|
||||
//
|
||||
// NOTE: this should be embedded by value instead of pointer to avoid a nil
|
||||
// pointer dereference when methods are called.
|
||||
type UnimplementedEngineServiceServer struct{}
|
||||
|
||||
func (UnimplementedEngineServiceServer) Mount(context.Context, *MountRequest) (*MountResponse, error) {
|
||||
return nil, status.Error(codes.Unimplemented, "method Mount not implemented")
|
||||
}
|
||||
func (UnimplementedEngineServiceServer) Unmount(context.Context, *UnmountRequest) (*UnmountResponse, error) {
|
||||
return nil, status.Error(codes.Unimplemented, "method Unmount not implemented")
|
||||
}
|
||||
func (UnimplementedEngineServiceServer) ListMounts(context.Context, *ListMountsRequest) (*ListMountsResponse, error) {
|
||||
return nil, status.Error(codes.Unimplemented, "method ListMounts not implemented")
|
||||
}
|
||||
func (UnimplementedEngineServiceServer) Request(context.Context, *EngineRequest) (*EngineResponse, error) {
|
||||
return nil, status.Error(codes.Unimplemented, "method Request not implemented")
|
||||
}
|
||||
func (UnimplementedEngineServiceServer) mustEmbedUnimplementedEngineServiceServer() {}
|
||||
func (UnimplementedEngineServiceServer) testEmbeddedByValue() {}
|
||||
|
||||
// UnsafeEngineServiceServer may be embedded to opt out of forward compatibility for this service.
|
||||
// Use of this interface is not recommended, as added methods to EngineServiceServer will
|
||||
// result in compilation errors.
|
||||
type UnsafeEngineServiceServer interface {
|
||||
mustEmbedUnimplementedEngineServiceServer()
|
||||
}
|
||||
|
||||
func RegisterEngineServiceServer(s grpc.ServiceRegistrar, srv EngineServiceServer) {
|
||||
// If the following call panics, it indicates UnimplementedEngineServiceServer was
|
||||
// embedded by pointer and is nil. This will cause panics if an
|
||||
// unimplemented method is ever invoked, so we test this at initialization
|
||||
// time to prevent it from happening at runtime later due to I/O.
|
||||
if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
|
||||
t.testEmbeddedByValue()
|
||||
}
|
||||
s.RegisterService(&EngineService_ServiceDesc, srv)
|
||||
}
|
||||
|
||||
func _EngineService_Mount_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
|
||||
in := new(MountRequest)
|
||||
if err := dec(in); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if interceptor == nil {
|
||||
return srv.(EngineServiceServer).Mount(ctx, in)
|
||||
}
|
||||
info := &grpc.UnaryServerInfo{
|
||||
Server: srv,
|
||||
FullMethod: EngineService_Mount_FullMethodName,
|
||||
}
|
||||
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
|
||||
return srv.(EngineServiceServer).Mount(ctx, req.(*MountRequest))
|
||||
}
|
||||
return interceptor(ctx, in, info, handler)
|
||||
}
|
||||
|
||||
func _EngineService_Unmount_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
|
||||
in := new(UnmountRequest)
|
||||
if err := dec(in); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if interceptor == nil {
|
||||
return srv.(EngineServiceServer).Unmount(ctx, in)
|
||||
}
|
||||
info := &grpc.UnaryServerInfo{
|
||||
Server: srv,
|
||||
FullMethod: EngineService_Unmount_FullMethodName,
|
||||
}
|
||||
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
|
||||
return srv.(EngineServiceServer).Unmount(ctx, req.(*UnmountRequest))
|
||||
}
|
||||
return interceptor(ctx, in, info, handler)
|
||||
}
|
||||
|
||||
func _EngineService_ListMounts_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
|
||||
in := new(ListMountsRequest)
|
||||
if err := dec(in); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if interceptor == nil {
|
||||
return srv.(EngineServiceServer).ListMounts(ctx, in)
|
||||
}
|
||||
info := &grpc.UnaryServerInfo{
|
||||
Server: srv,
|
||||
FullMethod: EngineService_ListMounts_FullMethodName,
|
||||
}
|
||||
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
|
||||
return srv.(EngineServiceServer).ListMounts(ctx, req.(*ListMountsRequest))
|
||||
}
|
||||
return interceptor(ctx, in, info, handler)
|
||||
}
|
||||
|
||||
func _EngineService_Request_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
|
||||
in := new(EngineRequest)
|
||||
if err := dec(in); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if interceptor == nil {
|
||||
return srv.(EngineServiceServer).Request(ctx, in)
|
||||
}
|
||||
info := &grpc.UnaryServerInfo{
|
||||
Server: srv,
|
||||
FullMethod: EngineService_Request_FullMethodName,
|
||||
}
|
||||
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
|
||||
return srv.(EngineServiceServer).Request(ctx, req.(*EngineRequest))
|
||||
}
|
||||
return interceptor(ctx, in, info, handler)
|
||||
}
|
||||
|
||||
// EngineService_ServiceDesc is the grpc.ServiceDesc for EngineService service.
|
||||
// It's only intended for direct use with grpc.RegisterService,
|
||||
// and not to be introspected or modified (even as a copy)
|
||||
var EngineService_ServiceDesc = grpc.ServiceDesc{
|
||||
ServiceName: "metacrypt.v1.EngineService",
|
||||
HandlerType: (*EngineServiceServer)(nil),
|
||||
Methods: []grpc.MethodDesc{
|
||||
{
|
||||
MethodName: "Mount",
|
||||
Handler: _EngineService_Mount_Handler,
|
||||
},
|
||||
{
|
||||
MethodName: "Unmount",
|
||||
Handler: _EngineService_Unmount_Handler,
|
||||
},
|
||||
{
|
||||
MethodName: "ListMounts",
|
||||
Handler: _EngineService_ListMounts_Handler,
|
||||
},
|
||||
{
|
||||
MethodName: "Request",
|
||||
Handler: _EngineService_Request_Handler,
|
||||
},
|
||||
},
|
||||
Streams: []grpc.StreamDesc{},
|
||||
Metadata: "metacrypt/v1/engine.proto",
|
||||
}
|
||||
Reference in New Issue
Block a user