Kyle Isom
64d921827e
Implement a two-level key hierarchy: the MEK now wraps per-engine DEKs stored in a new barrier_keys table, rather than encrypting all barrier entries directly. A v2 ciphertext format (0x02) embeds the key ID so the barrier can resolve which DEK to use on decryption. v1 ciphertext remains supported for backward compatibility. Key changes: - crypto: EncryptV2/DecryptV2/ExtractKeyID for v2 ciphertext with key IDs - barrier: key registry (CreateKey, RotateKey, ListKeys, MigrateToV2, ReWrapKeys) - seal: RotateMEK re-wraps DEKs without re-encrypting data - engine: Mount auto-creates per-engine DEK - REST + gRPC: barrier/keys, barrier/rotate-mek, barrier/rotate-key, barrier/migrate - proto: BarrierService (v1 + v2) with ListKeys, RotateMEK, RotateKey, Migrate - db: migration v2 adds barrier_keys table Also includes: security audit report, CSRF protection, engine design specs (sshca, transit, user), path-bound AAD migration tool, policy engine enhancements, and ARCHITECTURE.md updates. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
87 lines
2.9 KiB
HTML
87 lines
2.9 KiB
HTML
{{define "title"}} - Dashboard{{end}}
|
|
{{define "content"}}
|
|
<div class="page-header">
|
|
<h2>Dashboard</h2>
|
|
<div class="page-meta">
|
|
<span class="state-chip state-{{.State}}">{{.State}}</span>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="card">
|
|
<div class="card-title">Engine Mounts</div>
|
|
{{if .Mounts}}
|
|
<div class="table-wrapper">
|
|
<table>
|
|
<thead>
|
|
<tr>
|
|
<th>Name</th>
|
|
<th>Type</th>
|
|
<th>Path</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{{range .Mounts}}
|
|
<tr>
|
|
<td>
|
|
{{if eq (printf "%s" .Type) "ca"}}
|
|
<a href="/pki">{{.Name}}</a>
|
|
{{else}}
|
|
{{.Name}}
|
|
{{end}}
|
|
</td>
|
|
<td><code>{{.Type}}</code></td>
|
|
<td><code>{{.MountPath}}</code></td>
|
|
</tr>
|
|
{{end}}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
{{else}}
|
|
<p>No engines mounted.</p>
|
|
{{end}}
|
|
</div>
|
|
|
|
{{if .IsAdmin}}
|
|
<div class="card">
|
|
<div class="card-title">Mount Engine</div>
|
|
{{if .MountError}}<div class="error">{{.MountError}}</div>{{end}}
|
|
<details>
|
|
<summary>Mount a CA engine</summary>
|
|
<form method="post" action="/dashboard/mount-ca" enctype="multipart/form-data">
|
|
{{csrfField}}
|
|
<div class="form-row">
|
|
<div class="form-group">
|
|
<label for="mount_name">Mount Name</label>
|
|
<input type="text" id="mount_name" name="name" placeholder="pki" required>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="organization">Organization</label>
|
|
<input type="text" id="organization" name="organization" placeholder="Metacircular">
|
|
</div>
|
|
</div>
|
|
<details>
|
|
<summary>Import existing root CA (optional)</summary>
|
|
<div class="form-group">
|
|
<label for="cert_file">Certificate PEM</label>
|
|
<input type="file" id="cert_file" name="cert_file" accept=".pem,.crt">
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="key_file">Private Key PEM</label>
|
|
<input type="file" id="key_file" name="key_file" accept=".pem,.key">
|
|
</div>
|
|
</details>
|
|
<div class="form-actions">
|
|
<button type="submit">Mount</button>
|
|
</div>
|
|
</form>
|
|
</details>
|
|
</div>
|
|
|
|
<div class="card">
|
|
<div class="card-title">Administration</div>
|
|
<p>Sealing the service will require the seal password to restore access.</p>
|
|
<button class="btn-danger" hx-post="/v1/seal" hx-confirm="Are you sure you want to seal the service?">Seal Service</button>
|
|
</div>
|
|
{{end}}
|
|
{{end}}
|