feat: Build on push to main, push on releases.

.gitea/workflows/build-secretsserver.yaml

@@ -3,10 +3,9 @@ name: build-secretsserver
 on:
   push:
     branches:
-      - "main"
+      - main
-    # Only run on release tags.
+  # Only run on release tags.
-    tags:
+  tags: ["v*"]
-      - "v*"
   pull_request:
 
 jobs:
@@ -18,11 +17,11 @@ jobs:
       # Unfortunately gotta use a PAT,
       # workflow tokens can't access the registry yet.
       - name: Log in to the registry
-        if: ${{ gitea.ref_type == 'tag' }}
+        if: gitea.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: git.handmadecities.com
-          username: ${{ secrets.REGISTRY_USER }}
+          username: ${{ vars.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Compute tags

.gitea/workflows/release-clis.yaml

@@ -1,26 +0,0 @@
-name: release-clis
-
-on:
-  push:
-    tags:
-      - "v*"
-
-permissions:
-  code: read
-  releases: write
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        fetch-depth: 0
-    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-      with:
-        go-version-file: go.mod
-    - uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
-      with:
-        args: release --clean
-      env:
-        GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}

.gitignore

@@ -118,5 +118,3 @@ tags
 # Persistent undo
 [._]*.un~
 
-# Added by goreleaser init:
-dist/

.goreleaser.yaml

@@ -1,47 +0,0 @@
-version: 2
-
-gitea_urls:
-  api: https://git.handmadecities.com/api/v1
-  download: https://git.handmadecities.com/
-
-before:
-  hooks:
-    - go mod tidy
-
-builds:
-  - id: hmpki
-    main: ./cmd/hmpki
-    binary: hmpki
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - windows
-      - darwin
-    goarch:
-      - arm64
-      - amd64
-  - id: hmsecrets
-    main: ./cmd/hmsecrets
-    binary: hmsecrets
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - windows
-      - darwin
-    goarch:
-      - arm64
-      - amd64
-
-archives:
-  - formats: [tar.gz]
-    name_template: >-
-      {{ .ProjectName }}_
-      {{- title .Os }}_
-      {{- if eq .Arch "amd64" }}x86_64
-      {{- else }}{{ .Arch }}{{ end }}
-      {{- if .Arm }}v{{ .Arm }}{{ end }}
-    format_overrides:
-      - goos: windows
-        formats: [zip]

cmd/hmsecrets/main.go

@@ -1,8 +1,6 @@
 package main
 
-import (
+import "git.handmadecities.com/HMC/shhh/internal/clis/hmsecrets"
-	"git.handmadecities.com/HMC/shhh/internal/clis/hmsecrets"
-)
 
 func main() {
 	hmsecrets.Execute()

go.mod

@@ -11,5 +11,4 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	golang.org/x/sys v0.45.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

internal/clis/hmsecrets/cli.go

@@ -2,8 +2,8 @@ package hmsecrets
 
 import "git.handmadecities.com/HMC/shhh/pkg/secretsclient"
 
-func getClient() secretsclient.Client {
+func getClient(base, ca, cert, certKey string) secretsclient.Client {
-	cli, err := secretsclient.New(conf.APIBase, conf.CA, conf.ClientCert, conf.ClientKey)
+	cli, err := secretsclient.New(base, ca, cert, certKey)
 	if err != nil {
 		panic(err)
 	}

internal/clis/hmsecrets/config.go

@@ -1,83 +0,0 @@
-package hmsecrets
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path"
-	"runtime"
-
-	"gopkg.in/yaml.v3"
-)
-
-type config struct {
-	APIBase    string `yaml:"api-base"`
-	CA         string `yaml:"ca"`
-	ClientCert string `yaml:"client-cert"`
-	ClientKey  string `yaml:"client-key"`
-}
-
-func mustLoadConfig() config {
-	var baseConfigDir string
-	var err error
-	switch runtime.GOOS {
-	case "windows":
-		fallthrough
-	case "linux":
-		baseConfigDir, err = os.UserConfigDir()
-		if err != nil {
-			panic(fmt.Errorf("determining user config dir: %w", err))
-		}
-	case "darwin":
-		// We want $HOME/.config in macOS.
-		homeDir, err := os.UserHomeDir()
-		if err != nil {
-			panic(fmt.Errorf("determining user home dir: %w", err))
-		}
-		baseConfigDir = path.Join(homeDir, ".config")
-	}
-
-	configDir := path.Join(baseConfigDir, "hmsecrets")
-
-	configBytes, err := os.ReadFile(path.Join(configDir, "config.yaml"))
-	if err != nil {
-		panic(fmt.Errorf("reading config file: %w", err))
-	}
-	var conf config
-	err = yaml.Unmarshal(configBytes, &conf)
-	if err != nil {
-		panic(fmt.Errorf("parsing config file: %w", err))
-	}
-
-	if conf.APIBase == "" {
-		panic(errors.New("api base must be present in config"))
-	}
-
-	if conf.CA == "" {
-		conf.CA = path.Join(configDir, "ca.crt")
-	}
-	if !fileAccesible(conf.CA) {
-		panic(fmt.Errorf("ca file '%s' does not exist or is inaccesible", conf.CA))
-	}
-
-	if conf.ClientCert == "" {
-		conf.ClientCert = path.Join(configDir, "client.crt")
-	}
-	if !fileAccesible(conf.ClientCert) {
-		panic(fmt.Errorf("client cert file '%s' does not exist or is inaccesible", conf.ClientCert))
-	}
-
-	if conf.ClientKey == "" {
-		conf.ClientKey = path.Join(configDir, "client.key")
-	}
-	if !fileAccesible(conf.ClientKey) {
-		panic(fmt.Errorf("client key file '%s' does not exist or is inaccesible", conf.ClientKey))
-	}
-
-	return conf
-}
-
-func fileAccesible(f string) bool {
-	_, err := os.Stat(f)
-	return err == nil
-}

internal/clis/hmsecrets/delete.go

@@ -13,7 +13,7 @@ var delCmd = &cobra.Command{
 	Short: "del [key]",
 	Args:  cobra.ExactArgs(1),
 	RunE: func(cmd *cobra.Command, args []string) error {
-		cli := getClient()
+		cli := getClient(apiBase, caFile, clientCert, clientKey)
 		err := cli.Delete(args[0])
 		if err != nil {
 			return err

internal/clis/hmsecrets/get-arr.go

@@ -1,7 +1,6 @@
 package hmsecrets
 
 import (
-	"encoding/json"
 	"fmt"
 
 	"github.com/spf13/cobra"
@@ -16,16 +15,12 @@ var getArrCmd = &cobra.Command{
 	Short: "get-array [key]",
 	Args:  cobra.ExactArgs(1),
 	RunE: func(cmd *cobra.Command, args []string) error {
-		cli := getClient()
+		cli := getClient(apiBase, caFile, clientCert, clientKey)
 		secret, err := cli.GetStringArr(args[0])
 		if err != nil {
 			return err
 		}
-		secretJSON, err := json.MarshalIndent(secret, "", "  ")
+		fmt.Println(secret)
-		if err != nil {
-			return err
-		}
-		fmt.Println(string(secretJSON))
 		return nil
 	},
 }

internal/clis/hmsecrets/get-map.go

@@ -1,7 +1,6 @@
 package hmsecrets
 
 import (
-	"encoding/json"
 	"fmt"
 
 	"github.com/spf13/cobra"
@@ -16,16 +15,12 @@ var getMapCmd = &cobra.Command{
 	Short: "get-map [key]",
 	Args:  cobra.ExactArgs(1),
 	RunE: func(cmd *cobra.Command, args []string) error {
-		cli := getClient()
+		cli := getClient(apiBase, caFile, clientCert, clientKey)
 		secret, err := cli.GetStringMap(args[0])
 		if err != nil {
 			return err
 		}
-		secretJSON, err := json.MarshalIndent(secret, "", "  ")
+		fmt.Println(secret)
-		if err != nil {
-			return err
-		}
-		fmt.Println(string(secretJSON))
 		return nil
 	},
 }

internal/clis/hmsecrets/get.go

@@ -15,7 +15,7 @@ var getCmd = &cobra.Command{
 	Short: "get [key]",
 	Args:  cobra.ExactArgs(1),
 	RunE: func(cmd *cobra.Command, args []string) error {
-		cli := getClient()
+		cli := getClient(apiBase, caFile, clientCert, clientKey)
 		secret, err := cli.GetString(args[0])
 		if err != nil {
 			return err

internal/clis/hmsecrets/rootcmd.go

@@ -7,7 +7,44 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var conf config
+var apiBase string
+var caFile string
+var clientCert string
+var clientKey string
+
+func init() {
+	rootCmd.PersistentFlags().StringVar(
+		&apiBase,
+		"api-base",
+		"",
+		"base url for the service",
+	)
+	rootCmd.MarkPersistentFlagRequired("api-base")
+
+	rootCmd.PersistentFlags().StringVar(
+		&caFile,
+		"ca-file",
+		"",
+		"CA cert file",
+	)
+	rootCmd.MarkPersistentFlagRequired("ca-file")
+
+	rootCmd.PersistentFlags().StringVar(
+		&clientCert,
+		"client-cert",
+		"",
+		"certificate to be used for client mTLS auth",
+	)
+	rootCmd.MarkPersistentFlagRequired("client-cert")
+
+	rootCmd.PersistentFlags().StringVar(
+		&clientKey,
+		"client-key",
+		"",
+		"private key for the certificate to be used for client mTLS auth",
+	)
+	rootCmd.MarkPersistentFlagRequired("client-key")
+}
 
 var rootCmd = &cobra.Command{
 	Use:   "hmsecrets",
@@ -15,15 +52,6 @@ var rootCmd = &cobra.Command{
 }
 
 func Execute() {
-	defer func() {
-		if r := recover(); r != nil {
-			fmt.Printf("%+v\n", r)
-			os.Exit(1)
-		}
-	}()
-
-	conf = mustLoadConfig()
-
 	if err := rootCmd.Execute(); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)

internal/clis/hmsecrets/set-arr.go

@@ -1,35 +1,22 @@
 package hmsecrets
 
 import (
-	"encoding/json"
-	"fmt"
-	"os"
-
 	"github.com/spf13/cobra"
 )
 
 var arrValue []string
-var arrFile string
 
 func init() {
 	rootCmd.AddCommand(setArrCmd)
 
 	setArrCmd.Flags().StringArrayVarP(
 		&arrValue,
-		"value",
+		"array-value",
 		"v",
 		nil,
 		"array value to store in the secret",
 	)
-	setArrCmd.Flags().StringVarP(
+	setArrCmd.MarkFlagRequired("array-value")
-		&arrFile,
-		"value-file",
-		"f",
-		"",
-		"file that contains the secret value (in json) to set",
-	)
-
-	setArrCmd.MarkFlagsOneRequired("value-file", "value")
 }
 
 var setArrCmd = &cobra.Command{
@@ -37,17 +24,7 @@ var setArrCmd = &cobra.Command{
 	Short: "set-array [key]",
 	Args:  cobra.ExactArgs(1),
 	RunE: func(cmd *cobra.Command, args []string) error {
-		cli := getClient()
+		cli := getClient(apiBase, caFile, clientCert, clientKey)
-		if arrFile != "" {
-			arrJSONBytes, err := os.ReadFile(arrFile)
-			if err != nil {
-				return fmt.Errorf("reading array value file: %w", err)
-			}
-			err = json.Unmarshal(arrJSONBytes, &arrValue)
-			if err != nil {
-				return fmt.Errorf("reading value from array file: %w", err)
-			}
-		}
 		err := cli.PutStringArr(args[0], arrValue)
 		if err != nil {
 			return err

internal/clis/hmsecrets/set-map.go

@@ -1,35 +1,22 @@
 package hmsecrets
 
 import (
-	"encoding/json"
-	"fmt"
-	"os"
-
 	"github.com/spf13/cobra"
 )
 
 var mapValue map[string]string
-var mapFile string
 
 func init() {
 	rootCmd.AddCommand(setMapCmd)
 
 	setMapCmd.Flags().StringToStringVarP(
 		&mapValue,
-		"value",
+		"map-value",
 		"v",
 		nil,
 		"map value to store in the secret",
 	)
-	setMapCmd.Flags().StringVarP(
+	setArrCmd.MarkFlagRequired("map-value")
-		&mapFile,
-		"value-file",
-		"f",
-		"",
-		"file that contains the secret value (in json) to set",
-	)
-
-	setMapCmd.MarkFlagsOneRequired("value-file", "value")
 }
 
 var setMapCmd = &cobra.Command{
@@ -37,17 +24,7 @@ var setMapCmd = &cobra.Command{
 	Short: "set-map [key]",
 	Args:  cobra.ExactArgs(1),
 	RunE: func(cmd *cobra.Command, args []string) error {
-		cli := getClient()
+		cli := getClient(apiBase, caFile, clientCert, clientKey)
-		if mapFile != "" {
-			mapJSONBytes, err := os.ReadFile(mapFile)
-			if err != nil {
-				return fmt.Errorf("reading map value file: %w", err)
-			}
-			err = json.Unmarshal(mapJSONBytes, &mapValue)
-			if err != nil {
-				return fmt.Errorf("reading value from map file: %w", err)
-			}
-		}
 		err := cli.PutStringMap(args[0], mapValue)
 		if err != nil {
 			return err

internal/clis/hmsecrets/set.go

@@ -13,7 +13,7 @@ var setCmd = &cobra.Command{
 	Short: "set [key] [value]",
 	Args:  cobra.ExactArgs(2),
 	RunE: func(cmd *cobra.Command, args []string) error {
-		cli := getClient()
+		cli := getClient(apiBase, caFile, clientCert, clientKey)
 		err := cli.PutString(args[0], args[1])
 		if err != nil {
 			return err

mise.toml

@@ -2,4 +2,3 @@
 go = "1.27.2"
 "go:golang.org/x/tools/cmd/goimports" = "latest"
 "go:golang.org/x/tools/gopls" = "latest"
-goreleaser = "2.19.0"