Kyle Isom
4ddd32b117
Core packages: crypto (Argon2id/AES-256-GCM), config (TOML/viper), db (SQLite/migrations), barrier (encrypted storage), seal (state machine with rate-limited unseal), auth (MCIAS integration with token cache), policy (priority-based ACL engine), engine (interface + registry). Server: HTTPS with TLS 1.2+, REST API, auth/admin middleware, htmx web UI (init, unseal, login, dashboard pages). CLI: cobra/viper subcommands (server, init, status, snapshot) with env var override support (METACRYPT_ prefix). Operational tooling: Dockerfile (multi-stage, non-root), docker-compose, hardened systemd units (service + daily backup timer), install script, backup script with retention pruning, production config examples. Runbook covering installation, configuration, daily operations, backup/restore, monitoring, troubleshooting, and security procedures. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
102 lines
2.4 KiB
Go
102 lines
2.4 KiB
Go
// Package config provides TOML configuration loading and validation.
|
|
package config
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/pelletier/go-toml/v2"
|
|
)
|
|
|
|
// Config is the top-level configuration for Metacrypt.
|
|
type Config struct {
|
|
Server ServerConfig `toml:"server"`
|
|
Database DatabaseConfig `toml:"database"`
|
|
MCIAS MCIASConfig `toml:"mcias"`
|
|
Seal SealConfig `toml:"seal"`
|
|
Log LogConfig `toml:"log"`
|
|
}
|
|
|
|
// ServerConfig holds HTTP/gRPC server settings.
|
|
type ServerConfig struct {
|
|
ListenAddr string `toml:"listen_addr"`
|
|
GRPCAddr string `toml:"grpc_addr"`
|
|
TLSCert string `toml:"tls_cert"`
|
|
TLSKey string `toml:"tls_key"`
|
|
}
|
|
|
|
// DatabaseConfig holds SQLite database settings.
|
|
type DatabaseConfig struct {
|
|
Path string `toml:"path"`
|
|
}
|
|
|
|
// MCIASConfig holds MCIAS integration settings.
|
|
type MCIASConfig struct {
|
|
ServerURL string `toml:"server_url"`
|
|
CACert string `toml:"ca_cert"`
|
|
}
|
|
|
|
// SealConfig holds Argon2id parameters for the seal process.
|
|
type SealConfig struct {
|
|
Argon2Time uint32 `toml:"argon2_time"`
|
|
Argon2Memory uint32 `toml:"argon2_memory"`
|
|
Argon2Threads uint8 `toml:"argon2_threads"`
|
|
}
|
|
|
|
// LogConfig holds logging settings.
|
|
type LogConfig struct {
|
|
Level string `toml:"level"`
|
|
}
|
|
|
|
// Load reads and parses a TOML config file.
|
|
func Load(path string) (*Config, error) {
|
|
data, err := os.ReadFile(path)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("config: read file: %w", err)
|
|
}
|
|
var cfg Config
|
|
if err := toml.Unmarshal(data, &cfg); err != nil {
|
|
return nil, fmt.Errorf("config: parse: %w", err)
|
|
}
|
|
if err := cfg.Validate(); err != nil {
|
|
return nil, err
|
|
}
|
|
return &cfg, nil
|
|
}
|
|
|
|
// Validate checks required fields and applies defaults.
|
|
func (c *Config) Validate() error {
|
|
if c.Server.ListenAddr == "" {
|
|
return fmt.Errorf("config: server.listen_addr is required")
|
|
}
|
|
if c.Server.TLSCert == "" {
|
|
return fmt.Errorf("config: server.tls_cert is required")
|
|
}
|
|
if c.Server.TLSKey == "" {
|
|
return fmt.Errorf("config: server.tls_key is required")
|
|
}
|
|
if c.Database.Path == "" {
|
|
return fmt.Errorf("config: database.path is required")
|
|
}
|
|
if c.MCIAS.ServerURL == "" {
|
|
return fmt.Errorf("config: mcias.server_url is required")
|
|
}
|
|
|
|
// Apply defaults for seal parameters.
|
|
if c.Seal.Argon2Time == 0 {
|
|
c.Seal.Argon2Time = 3
|
|
}
|
|
if c.Seal.Argon2Memory == 0 {
|
|
c.Seal.Argon2Memory = 128 * 1024
|
|
}
|
|
if c.Seal.Argon2Threads == 0 {
|
|
c.Seal.Argon2Threads = 4
|
|
}
|
|
|
|
if c.Log.Level == "" {
|
|
c.Log.Level = "info"
|
|
}
|
|
|
|
return nil
|
|
}
|