Kyle Isom
8f77050a84
Add the first concrete engine implementation: a CA (PKI) engine that generates
a self-signed root CA at mount time, issues scoped intermediate CAs ("issuers"),
and signs leaf certificates using configurable profiles (server, client, peer).
Engine framework updates:
- Add CallerInfo struct for auth context in engine requests
- Add config parameter to Engine.Initialize for mount-time configuration
- Export Mount.Engine field; add GetEngine/GetMount on Registry
CA engine (internal/engine/ca/):
- Two-tier PKI: root CA → issuers → leaf certificates
- 10 operations: get-root, get-chain, get-issuer, create/delete/list issuers,
issue, get-cert, list-certs, renew
- Certificate profiles with user-overridable TTL, key usages, and key algorithm
- Private keys never stored in barrier; zeroized from memory on seal
- Supports ECDSA, RSA, and Ed25519 key types via goutils/certlib/certgen
Server routes:
- Wire up engine mount/request handlers (replace Phase 1 stubs)
- Add public PKI routes (/v1/pki/{mount}/ca, /ca/chain, /issuer/{name})
for unauthenticated TLS trust bootstrapping
Also includes: ARCHITECTURE.md, deploy config updates, operational tooling.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
59 lines
1.2 KiB
Go
59 lines
1.2 KiB
Go
package main
|
|
|
|
import (
|
|
"database/sql"
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/spf13/cobra"
|
|
|
|
"git.wntrmute.dev/kyle/metacrypt/internal/config"
|
|
"git.wntrmute.dev/kyle/metacrypt/internal/db"
|
|
)
|
|
|
|
var snapshotCmd = &cobra.Command{
|
|
Use: "snapshot",
|
|
Short: "Create a database snapshot",
|
|
Long: "Create a backup of the Metacrypt database using SQLite's VACUUM INTO.",
|
|
RunE: runSnapshot,
|
|
}
|
|
|
|
var snapshotOutput string
|
|
|
|
func init() {
|
|
snapshotCmd.Flags().StringVarP(&snapshotOutput, "output", "o", "backup.db", "output file path")
|
|
rootCmd.AddCommand(snapshotCmd)
|
|
}
|
|
|
|
func runSnapshot(cmd *cobra.Command, args []string) error {
|
|
configPath := cfgFile
|
|
if configPath == "" {
|
|
configPath = "/srv/metacrypt/metacrypt.toml"
|
|
}
|
|
|
|
cfg, err := config.Load(configPath)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
database, err := db.Open(cfg.Database.Path)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer database.Close()
|
|
|
|
if err := sqliteBackup(database, snapshotOutput); err != nil {
|
|
return err
|
|
}
|
|
fmt.Printf("Snapshot saved to %s\n", snapshotOutput)
|
|
return nil
|
|
}
|
|
|
|
func sqliteBackup(srcDB *sql.DB, dstPath string) error {
|
|
_, err := srcDB.Exec("VACUUM INTO ?", dstPath)
|
|
if err != nil {
|
|
return fmt.Errorf("snapshot: %w", err)
|
|
}
|
|
return os.Chmod(dstPath, 0600)
|
|
}
|