Separate web UI into standalone metacrypt-web binary

The vault server holds in-memory unsealed state (KEK, engine keys) that
is lost on restart, requiring a full unseal ceremony. Previously the web
UI ran inside the vault process, so any UI change forced a restart and
re-unseal.

This change extracts the web UI into a separate metacrypt-web binary
that communicates with the vault over an authenticated gRPC connection.
The web server carries no sealed state and can be restarted freely.

- gen/metacrypt/v1/: generated Go bindings from proto/metacrypt/v1/
- internal/grpcserver/: full gRPC server implementation (System, Auth,
  Engine, PKI, Policy, ACME services) with seal/auth/admin interceptors
- internal/webserver/: web server with gRPC vault client; templates
  embedded via web/embed.go (no runtime web/ directory needed)
- cmd/metacrypt-web/: standalone binary entry point
- internal/config: added [web] section (listen_addr, vault_grpc, etc.)
- internal/server/routes.go: removed all web UI routes and handlers
- cmd/metacrypt/server.go: starts gRPC server alongside HTTP server
- Deploy: Dockerfile builds both binaries, docker-compose adds
  metacrypt-web service, new metacrypt-web.service systemd unit,
  Makefile gains proto/metacrypt-web targets

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
2026-03-15 09:07:12 -07:00
parent b8e348db03
commit cc1ac2e255
37 changed files with 5668 additions and 647 deletions

View File

@@ -0,0 +1,235 @@
// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
// versions:
// - protoc-gen-go-grpc v1.6.1
// - protoc v3.20.3
// source: metacrypt/v1/engine.proto
package metacryptv1
import (
context "context"
grpc "google.golang.org/grpc"
codes "google.golang.org/grpc/codes"
status "google.golang.org/grpc/status"
)
// This is a compile-time assertion to ensure that this generated file
// is compatible with the grpc package it is being compiled against.
// Requires gRPC-Go v1.64.0 or later.
const _ = grpc.SupportPackageIsVersion9
const (
EngineService_Mount_FullMethodName = "/metacrypt.v1.EngineService/Mount"
EngineService_Unmount_FullMethodName = "/metacrypt.v1.EngineService/Unmount"
EngineService_ListMounts_FullMethodName = "/metacrypt.v1.EngineService/ListMounts"
EngineService_Request_FullMethodName = "/metacrypt.v1.EngineService/Request"
)
// EngineServiceClient is the client API for EngineService service.
//
// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
type EngineServiceClient interface {
Mount(ctx context.Context, in *MountRequest, opts ...grpc.CallOption) (*MountResponse, error)
Unmount(ctx context.Context, in *UnmountRequest, opts ...grpc.CallOption) (*UnmountResponse, error)
ListMounts(ctx context.Context, in *ListMountsRequest, opts ...grpc.CallOption) (*ListMountsResponse, error)
Request(ctx context.Context, in *EngineRequest, opts ...grpc.CallOption) (*EngineResponse, error)
}
type engineServiceClient struct {
cc grpc.ClientConnInterface
}
func NewEngineServiceClient(cc grpc.ClientConnInterface) EngineServiceClient {
return &engineServiceClient{cc}
}
func (c *engineServiceClient) Mount(ctx context.Context, in *MountRequest, opts ...grpc.CallOption) (*MountResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(MountResponse)
err := c.cc.Invoke(ctx, EngineService_Mount_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
func (c *engineServiceClient) Unmount(ctx context.Context, in *UnmountRequest, opts ...grpc.CallOption) (*UnmountResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(UnmountResponse)
err := c.cc.Invoke(ctx, EngineService_Unmount_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
func (c *engineServiceClient) ListMounts(ctx context.Context, in *ListMountsRequest, opts ...grpc.CallOption) (*ListMountsResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(ListMountsResponse)
err := c.cc.Invoke(ctx, EngineService_ListMounts_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
func (c *engineServiceClient) Request(ctx context.Context, in *EngineRequest, opts ...grpc.CallOption) (*EngineResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(EngineResponse)
err := c.cc.Invoke(ctx, EngineService_Request_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
// EngineServiceServer is the server API for EngineService service.
// All implementations must embed UnimplementedEngineServiceServer
// for forward compatibility.
type EngineServiceServer interface {
Mount(context.Context, *MountRequest) (*MountResponse, error)
Unmount(context.Context, *UnmountRequest) (*UnmountResponse, error)
ListMounts(context.Context, *ListMountsRequest) (*ListMountsResponse, error)
Request(context.Context, *EngineRequest) (*EngineResponse, error)
mustEmbedUnimplementedEngineServiceServer()
}
// UnimplementedEngineServiceServer must be embedded to have
// forward compatible implementations.
//
// NOTE: this should be embedded by value instead of pointer to avoid a nil
// pointer dereference when methods are called.
type UnimplementedEngineServiceServer struct{}
func (UnimplementedEngineServiceServer) Mount(context.Context, *MountRequest) (*MountResponse, error) {
return nil, status.Error(codes.Unimplemented, "method Mount not implemented")
}
func (UnimplementedEngineServiceServer) Unmount(context.Context, *UnmountRequest) (*UnmountResponse, error) {
return nil, status.Error(codes.Unimplemented, "method Unmount not implemented")
}
func (UnimplementedEngineServiceServer) ListMounts(context.Context, *ListMountsRequest) (*ListMountsResponse, error) {
return nil, status.Error(codes.Unimplemented, "method ListMounts not implemented")
}
func (UnimplementedEngineServiceServer) Request(context.Context, *EngineRequest) (*EngineResponse, error) {
return nil, status.Error(codes.Unimplemented, "method Request not implemented")
}
func (UnimplementedEngineServiceServer) mustEmbedUnimplementedEngineServiceServer() {}
func (UnimplementedEngineServiceServer) testEmbeddedByValue() {}
// UnsafeEngineServiceServer may be embedded to opt out of forward compatibility for this service.
// Use of this interface is not recommended, as added methods to EngineServiceServer will
// result in compilation errors.
type UnsafeEngineServiceServer interface {
mustEmbedUnimplementedEngineServiceServer()
}
func RegisterEngineServiceServer(s grpc.ServiceRegistrar, srv EngineServiceServer) {
// If the following call panics, it indicates UnimplementedEngineServiceServer was
// embedded by pointer and is nil. This will cause panics if an
// unimplemented method is ever invoked, so we test this at initialization
// time to prevent it from happening at runtime later due to I/O.
if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
t.testEmbeddedByValue()
}
s.RegisterService(&EngineService_ServiceDesc, srv)
}
func _EngineService_Mount_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(MountRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(EngineServiceServer).Mount(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: EngineService_Mount_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(EngineServiceServer).Mount(ctx, req.(*MountRequest))
}
return interceptor(ctx, in, info, handler)
}
func _EngineService_Unmount_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(UnmountRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(EngineServiceServer).Unmount(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: EngineService_Unmount_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(EngineServiceServer).Unmount(ctx, req.(*UnmountRequest))
}
return interceptor(ctx, in, info, handler)
}
func _EngineService_ListMounts_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(ListMountsRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(EngineServiceServer).ListMounts(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: EngineService_ListMounts_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(EngineServiceServer).ListMounts(ctx, req.(*ListMountsRequest))
}
return interceptor(ctx, in, info, handler)
}
func _EngineService_Request_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(EngineRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(EngineServiceServer).Request(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: EngineService_Request_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(EngineServiceServer).Request(ctx, req.(*EngineRequest))
}
return interceptor(ctx, in, info, handler)
}
// EngineService_ServiceDesc is the grpc.ServiceDesc for EngineService service.
// It's only intended for direct use with grpc.RegisterService,
// and not to be introspected or modified (even as a copy)
var EngineService_ServiceDesc = grpc.ServiceDesc{
ServiceName: "metacrypt.v1.EngineService",
HandlerType: (*EngineServiceServer)(nil),
Methods: []grpc.MethodDesc{
{
MethodName: "Mount",
Handler: _EngineService_Mount_Handler,
},
{
MethodName: "Unmount",
Handler: _EngineService_Unmount_Handler,
},
{
MethodName: "ListMounts",
Handler: _EngineService_ListMounts_Handler,
},
{
MethodName: "Request",
Handler: _EngineService_Request_Handler,
},
},
Streams: []grpc.StreamDesc{},
Metadata: "metacrypt/v1/engine.proto",
}