nordisk/holger

examples/mirror-credentials/upstream-credentials.ron

// Upstream credentials for a continuous mirror — the shape `holger-agent-lib`'s
// `creds::UpstreamCredsConfig` parses (see `agent/lib/src/creds.rs`).
//
// A repository names WHERE its credential lives; it never writes the credential.
// The vault is `nornir-vault` (edda): AES-256-GCM envelope encryption, a 0600
// file, secrets that have no `Serialize`, `Display` or revealing `Debug`.
//
// Provision an entry once (pure Rust, from the agent's own code):
//
//     let mut v = Vault::create(path, &PinProvider::new(pin))?;   // or open+unlock
//     v.set_with_meta(
//         "nexus-mirror",
//         agent_lib::creds::registry_creds_entry("mirror-bot", password),
//         Some(agent_lib::creds::REGISTRY_CREDS_LABEL),   // "registry-creds"
//         Some(&stamp),
//     )?;
//
// At boot the agent opens each named vault ONCE, unlocks it with the provider
// named below, decodes every named entry into memory for the process lifetime,
// and locks the vault again. A missing vault, a vault that will not unlock, or
// an absent entry REFUSES THE BOOT, by name — it never degrades to anonymous.
(
    // Which key opens the vault. `Pin` = Argon2id over an operator PIN supplied
    // in-process (a prompt, a systemd credential) — never from this file and
    // never from an environment variable. `OsKeyring(ron_service: "…",
    // ron_account: "…")` needs `--features vault-os-keyring`; without it a config
    // that names it is refused with the rebuild hint rather than falling back.
    ron_vault_provider: Pin,

    ron_repositories: [
        // Basic credentials for a Nexus upstream, stored as an `Opaque` entry
        // labelled "registry-creds" holding `(username: "…", password: "…")`.
        (
            ron_name: "nexus-mirror",
            ron_credential: Vault(
                ron_vault_path: "/var/lib/holger/agent.vault",
                ron_entry: "nexus-mirror",
            ),
        ),

        // An Artifactory access token — the same reference; the entry's KIND in
        // the vault (`SparkToken`) is what makes it a bearer credential, and an
        // `MtlsClientIdentity` entry becomes an mTLS client identity.
        (
            ron_name: "artifactory-mirror",
            ron_credential: Vault(
                ron_vault_path: "/var/lib/holger/agent.vault",
                ron_entry: "artifactory-token",
            ),
        ),

        // An upstream that needs nothing.
        (
            ron_name: "public-crates",
            ron_credential: Anonymous,
        ),

        // THIS IS REFUSED AT BOOT, BY NAME. It parses — deliberately, so the
        // refusal can say "repository \"bad-example\" uses Basic(ron_username,
        // ron_password)" instead of "unknown variant" — but the values are
        // discarded at deserialize time and never retained, so there is nothing
        // for the refusal, a log line or a rendered config to leak.
        //
        // ( ron_name: "bad-example", ron_credential: Basic(
        //     ron_username: "mirror-bot", ron_password: "hunter2" ) ),
    ],
)