Kyle Isom
cc1ac2e255
The vault server holds in-memory unsealed state (KEK, engine keys) that is lost on restart, requiring a full unseal ceremony. Previously the web UI ran inside the vault process, so any UI change forced a restart and re-unseal. This change extracts the web UI into a separate metacrypt-web binary that communicates with the vault over an authenticated gRPC connection. The web server carries no sealed state and can be restarted freely. - gen/metacrypt/v1/: generated Go bindings from proto/metacrypt/v1/ - internal/grpcserver/: full gRPC server implementation (System, Auth, Engine, PKI, Policy, ACME services) with seal/auth/admin interceptors - internal/webserver/: web server with gRPC vault client; templates embedded via web/embed.go (no runtime web/ directory needed) - cmd/metacrypt-web/: standalone binary entry point - internal/config: added [web] section (listen_addr, vault_grpc, etc.) - internal/server/routes.go: removed all web UI routes and handlers - cmd/metacrypt/server.go: starts gRPC server alongside HTTP server - Deploy: Dockerfile builds both binaries, docker-compose adds metacrypt-web service, new metacrypt-web.service systemd unit, Makefile gains proto/metacrypt-web targets Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
39 lines
879 B
Makefile
39 lines
879 B
Makefile
.PHONY: build test vet clean docker all devserver metacrypt metacrypt-web proto
|
|
|
|
LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(shell git describe --tags --always --dirty 2>/dev/null || echo dev)"
|
|
|
|
proto:
|
|
protoc --go_out=. --go_opt=paths=source_relative \
|
|
--go-grpc_out=. --go-grpc_opt=paths=source_relative \
|
|
proto/metacrypt/v1/*.proto
|
|
|
|
metacrypt:
|
|
go build $(LDFLAGS) -o metacrypt ./cmd/metacrypt
|
|
|
|
metacrypt-web:
|
|
go build $(LDFLAGS) -o metacrypt-web ./cmd/metacrypt-web
|
|
|
|
build:
|
|
go build ./...
|
|
|
|
test:
|
|
go test ./...
|
|
|
|
vet:
|
|
go vet ./...
|
|
|
|
clean:
|
|
rm -f metacrypt metacrypt-web
|
|
|
|
docker:
|
|
docker build -t metacrypt .
|
|
|
|
docker-compose:
|
|
docker compose -f deploy/docker/docker-compose.yml up --build
|
|
|
|
devserver: metacrypt metacrypt-web
|
|
./metacrypt server --config srv/metacrypt.toml &
|
|
./metacrypt-web --config srv/metacrypt.toml
|
|
|
|
all: vet test metacrypt metacrypt-web
|