Kyle Isom
28d6f9fa1f
ListIssuers was miscategorized as a public gRPC method, but the CA engine handler requires CallerInfo with user role. When called without auth (public path), the interceptor skipped token validation, so CallerInfo was nil and the handler returned ErrUnauthorized — which the web UI silently swallowed, showing "No issuers configured." Security: gRPC interceptor map correction (ListIssuers requires auth) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Metacrypt
Metacrypt is a cryptographic service for the Metacircular platform. It provides an encrypted secrets barrier and pluggable cryptographic engines (CA/PKI, SSH CA, transit encryption, user-to-user encryption) over a gRPC and HTTPS API. Authentication is delegated to MCIAS.
It operates using a seal/unseal model similar to HashiCorp Vault: the service starts sealed on every boot and must be unlocked with a password before cryptographic operations are available.
Quick Start
Prerequisites
- Go 1.23+
- A running MCIAS instance
- TLS certificate and key for the server
Build
make metacrypt metacrypt-web
Configure
cp deploy/examples/metacrypt.toml /srv/metacrypt/metacrypt.toml
# Edit to set listen_addr, tls_cert, tls_key, database.path, mcias.server_url
Initialize
./metacrypt init --config /srv/metacrypt/metacrypt.toml
This prompts for a seal password and generates the master encryption key. Store the seal password securely — it cannot be recovered if lost.
Run
./metacrypt server --config /srv/metacrypt/metacrypt.toml
The service starts sealed. Unseal it:
curl -sk -X POST https://localhost:8443/v1/unseal \
-H 'Content-Type: application/json' \
-d '{"password":"<seal-password>"}'
Or use the web UI: navigate to https://<host>:8443/.
Docker
make docker
docker compose -f deploy/docker/docker-compose.yml up -d
See RUNBOOK.md for volume setup instructions.
Further Reading
| Document | Contents |
|---|---|
| ARCHITECTURE.md | Cryptographic design, key hierarchy, engine architecture, API reference, security model |
| RUNBOOK.md | Installation, daily operations, backup/restore, monitoring, troubleshooting |
| PKI-ENGINE-PLAN.md | CA engine implementation plan |
Development
make build # Build all packages
make test # Run tests
make vet # Static analysis
make lint # golangci-lint
make proto # Regenerate protobuf/gRPC stubs
make proto-lint # Lint and check proto breaking changes