Kyle Isom
8f77050a84
Add the first concrete engine implementation: a CA (PKI) engine that generates
a self-signed root CA at mount time, issues scoped intermediate CAs ("issuers"),
and signs leaf certificates using configurable profiles (server, client, peer).
Engine framework updates:
- Add CallerInfo struct for auth context in engine requests
- Add config parameter to Engine.Initialize for mount-time configuration
- Export Mount.Engine field; add GetEngine/GetMount on Registry
CA engine (internal/engine/ca/):
- Two-tier PKI: root CA → issuers → leaf certificates
- 10 operations: get-root, get-chain, get-issuer, create/delete/list issuers,
issue, get-cert, list-certs, renew
- Certificate profiles with user-overridable TTL, key usages, and key algorithm
- Private keys never stored in barrier; zeroized from memory on seal
- Supports ECDSA, RSA, and Ed25519 key types via goutils/certlib/certgen
Server routes:
- Wire up engine mount/request handlers (replace Phase 1 stubs)
- Add public PKI routes (/v1/pki/{mount}/ca, /ca/chain, /issuer/{name})
for unauthenticated TLS trust bootstrapping
Also includes: ARCHITECTURE.md, deploy config updates, operational tooling.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
24 lines
781 B
Bash
Executable File
24 lines
781 B
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Create a timestamped Metacrypt database backup and prune old ones.
|
|
#
|
|
# Usage: ./backup.sh [retention_days]
|
|
# retention_days: number of days to keep backups (default: 30)
|
|
#
|
|
set -euo pipefail
|
|
|
|
CONFIG="${METACRYPT_CONFIG:-/srv/metacrypt/metacrypt.toml}"
|
|
BACKUP_DIR="${METACRYPT_BACKUP_DIR:-/srv/metacrypt/backups}"
|
|
RETENTION_DAYS="${1:-30}"
|
|
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
|
|
BACKUP_FILE="${BACKUP_DIR}/metacrypt-${TIMESTAMP}.db"
|
|
|
|
echo "==> Creating backup: ${BACKUP_FILE}"
|
|
metacrypt snapshot --config "$CONFIG" --output "$BACKUP_FILE"
|
|
|
|
echo "==> Pruning backups older than ${RETENTION_DAYS} days"
|
|
find "$BACKUP_DIR" -name 'metacrypt-*.db' -mtime "+${RETENTION_DAYS}" -delete -print
|
|
|
|
echo "==> Done"
|
|
ls -lh "$BACKUP_DIR"/metacrypt-*.db 2>/dev/null | tail -5
|