initial commit

pkg/api/client/client.go

@@ -0,0 +1,213 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type Client struct {
+	endpoint    string
+	username    string
+	password    string
+	auth        bool
+	httpClient  *http.Client
+	debugWriter io.Writer
+	insecure    bool
+}
+
+var (
+	ErrNotFound = errors.New("not found")
+)
+
+type ClientOption func(*Client)
+
+func WithEndpoint(endpoint string) ClientOption {
+	return func(client *Client) {
+		client.endpoint = strings.TrimRight(endpoint, "/")
+	}
+}
+
+func WithDebugWriter(debugWriter io.Writer) ClientOption {
+	return func(client *Client) {
+		client.debugWriter = debugWriter
+	}
+}
+
+func WithHTTPClient(httpClient *http.Client) ClientOption {
+	return func(client *Client) {
+		client.httpClient = httpClient
+	}
+}
+
+func WithInsecureClient(insecure bool) ClientOption {
+	return func(client *Client) {
+		client.insecure = insecure
+	}
+}
+
+func WithCredentials(username, password string) ClientOption {
+	return func(client *Client) {
+		client.username = username
+		client.password = password
+		client.auth = true
+	}
+}
+
+var (
+	ErrMissingEndpointEnv = errors.New("missing environment variable HAPROXY_LB_ENDPOINT")
+	ErrMissingUserEnv     = errors.New("missing environment variable HAPROXY_LB_USER")
+	ErrMissingPasswordEnv = errors.New("missing environment variable HAPROXY_LB_PASSWORD")
+
+	ErrMissingEndpoint = errors.New("missing Endpoint in config")
+	ErrMissingUser     = errors.New("missing User in config")
+	ErrMissingPassword = errors.New("missing Password in config")
+)
+
+type Config struct {
+	Endpoint string `json:"endpoint"`
+	NoAuth   bool   `json:"no_auth"`
+	User     string `json:"user"`
+	Password string `json:"password"`
+	Insecure bool   `json:"insecure"`
+}
+
+func ClientOptionsFromConfig(cfg Config) (options []ClientOption, err error) {
+	if cfg.Endpoint == "" {
+		err = ErrMissingEndpoint
+		return
+	}
+	options = []ClientOption{
+		WithEndpoint(cfg.Endpoint),
+		WithInsecureClient(cfg.Insecure),
+	}
+	if cfg.NoAuth {
+		return
+	}
+	if cfg.User == "" {
+		err = ErrMissingUser
+		return
+	}
+	if cfg.Password == "" {
+		err = ErrMissingPassword
+		return
+	}
+	options = append(options, WithCredentials(cfg.User, cfg.Password))
+	return
+}
+
+func ClientOptionsFromEnv() (options []ClientOption, err error) {
+	endpoint := os.Getenv("HAPROXY_LB_ENDPOINT")
+	if endpoint == "" {
+		err = ErrMissingEndpointEnv
+		return
+	}
+	insecure, _ := strconv.ParseBool(os.Getenv("HAPROXY_LB_INSECURE"))
+
+	options = []ClientOption{
+		WithEndpoint(endpoint),
+		WithInsecureClient(insecure),
+	}
+	noAuth, _ := strconv.ParseBool(os.Getenv("HAPROXY_LB_NO_AUTH"))
+	if noAuth {
+		return
+	}
+
+	user := os.Getenv("HAPROXY_LB_USER")
+	if user == "" {
+		err = ErrMissingUserEnv
+		return
+	}
+
+	pass := os.Getenv("HAPROXY_LB_PASSWORD")
+	if pass == "" {
+		err = ErrMissingPasswordEnv
+		return
+	}
+
+	options = append(options, WithCredentials(user, pass))
+	return
+}
+
+func NewClient(options ...ClientOption) *Client {
+	client := &Client{}
+
+	for _, option := range options {
+		option(client)
+	}
+
+	if client.httpClient == nil {
+		client.httpClient = &http.Client{Transport: &http.Transport{
+			DialContext: (&net.Dialer{
+				Timeout:   30 * time.Second,
+				KeepAlive: 30 * time.Second,
+			}).DialContext,
+			ForceAttemptHTTP2:     true,
+			MaxIdleConns:          100,
+			IdleConnTimeout:       90 * time.Second,
+			TLSHandshakeTimeout:   10 * time.Second,
+			ExpectContinueTimeout: 1 * time.Second,
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: client.insecure,
+			},
+		}}
+	}
+	return client
+}
+
+func (c *Client) NewRequest(ctx context.Context, method, path string, body io.Reader) (*http.Request, error) {
+	url := c.endpoint + path
+	req, err := http.NewRequest(method, url, body)
+	if err != nil {
+		return nil, err
+	}
+	if c.auth {
+		req.SetBasicAuth(c.username, c.password)
+	}
+	req = req.WithContext(ctx)
+	return req, nil
+}
+
+func (c *Client) Do(r *http.Request, v interface{}) (resp *http.Response, err error) {
+	if c.debugWriter != nil {
+		dumpReq, err := httputil.DumpRequestOut(r, true)
+		if err != nil {
+			return &http.Response{}, err
+		}
+		fmt.Fprintf(c.debugWriter, "--- Request:\n%s\n\n", dumpReq)
+	}
+	resp, err = c.httpClient.Do(r)
+	if err != nil {
+		return
+	}
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		resp.Body.Close()
+		return
+	}
+	resp.Body.Close()
+	resp.Body = io.NopCloser(bytes.NewReader(body))
+
+	if c.debugWriter != nil {
+		dumpResp, err := httputil.DumpResponse(resp, true)
+		if err != nil {
+			return resp, err
+		}
+		fmt.Fprintf(c.debugWriter, "--- Response:\n%s\n\n", dumpResp)
+	}
+
+	err = decodeResp(resp, v)
+	return
+}

pkg/api/client/helper.go

@@ -0,0 +1,43 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package client
+
+import (
+	"encoding/json"
+	"net/http"
+)
+
+type Error struct {
+	Err    string `json:"error"`
+	Status int    `json:"status"`
+}
+
+func (e Error) Error() string {
+	return e.Err
+}
+
+func (e Error) Is(target error) bool {
+	return e.Err == target.Error()
+}
+
+func decodeResp(resp *http.Response, v interface{}) error {
+	if resp.Body == nil {
+		return nil
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == 200 {
+		if v == nil {
+			return nil
+		}
+		return json.NewDecoder(resp.Body).Decode(&v)
+	}
+	var e Error
+	err := json.NewDecoder(resp.Body).Decode(&e)
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode >= 400 && resp.StatusCode <= 599 {
+		return e
+	}
+	return nil
+}

pkg/api/server.go

@@ -0,0 +1,101 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package api
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"time"
+
+	"git.giftfish.de/ston1th/keyctl/pkg/api/types"
+	serverv1 "git.giftfish.de/ston1th/keyctl/pkg/api/v1/server"
+	"git.giftfish.de/ston1th/keyctl/pkg/db"
+
+	"github.com/go-logr/logr"
+	"github.com/gorilla/mux"
+)
+
+// Server is the webapp and api server
+type Server struct {
+	srv *http.Server
+	mux *mux.Router
+	log logr.Logger
+
+	Data *types.ContextData
+
+	init         chan struct{}
+	stop         chan struct{}
+	stopKeyReset chan struct{}
+
+	listen net.Listener
+
+	db *db.DB
+}
+
+type notFoundHandler struct {
+	s *Server
+}
+
+func (nf *notFoundHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	types.NewContext(w, r, nf.s.Data, nf.s.log).Err(types.ErrInvalidAPIRoute)
+}
+
+// NewHTTPServer returns a new HTTPServer
+func NewServer(log logr.Logger, listen string) (*Server, error) {
+	s := &Server{
+		mux:  mux.NewRouter(),
+		log:  log,
+		Data: &types.ContextData{},
+
+		init:         make(chan struct{}),
+		stop:         make(chan struct{}),
+		stopKeyReset: make(chan struct{}),
+	}
+	l, err := net.Listen("tcp", listen)
+	if err != nil {
+		return nil, err
+	}
+	s.listen = l
+
+	s.mux.NotFoundHandler = &notFoundHandler{s}
+	for _, v := range serverv1.Routes {
+		s.mux.HandleFunc(v.Path, s.contextWrapper(v.Handler)).Methods(v.Methods...)
+	}
+	s.start()
+	return s, nil
+}
+
+func (s *Server) start() {
+	s.srv = &http.Server{
+		Handler:      s.mux,
+		ReadTimeout:  10 * time.Second,
+		WriteTimeout: 10 * time.Second,
+	}
+	go func() {
+		<-s.init
+		err := s.srv.Serve(s.listen)
+		if err != nil {
+			s.log.Error(err, "")
+		}
+	}()
+	return
+}
+
+func (s *Server) contextWrapper(h types.CtxHandler) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		h(types.NewContext(w, r, s.Data, s.log))
+	}
+}
+
+// Stop stops listening for incoming connections and closes currently open connections
+func (s *Server) Stop() {
+	s.log.Info("stopping")
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+	err := s.srv.Shutdown(ctx)
+	if err != nil {
+		s.log.Error(err, "")
+	}
+	s.log.Info("stopped")
+}

pkg/api/types/approver.go

@@ -0,0 +1,103 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package types
+
+import (
+	"sync"
+	"time"
+
+	"git.giftfish.de/ston1th/keyctl/pkg/key"
+	"golang.org/x/exp/maps"
+)
+
+const maxSize = 10
+
+type ApprovalMap map[string]Approval
+
+type Approver struct {
+	// protects m
+	mu sync.RWMutex
+	m  ApprovalMap
+}
+
+func NewApprover() *Approver {
+	return &Approver{
+		m: make(ApprovalMap),
+	}
+}
+
+func (a *Approver) New(id, name string) (aid string, err error) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	size := len(a.m)
+	if size > maxSize {
+		err = ErrTooManyApprovals
+		return
+	}
+	aid, err = key.GenerateID()
+	if err != nil {
+		return
+	}
+	a.m[aid] = Approval{
+		ID:      id,
+		Name:    name,
+		Created: time.Now().Unix(),
+	}
+	return
+}
+
+func (a *Approver) List() (m ApprovalMap) {
+	a.mu.RLock()
+	m = maps.Clone(a.m)
+	a.mu.RUnlock()
+	return
+}
+func (a *Approver) Status(id, aid string) (s Status) {
+	a.mu.RLock()
+	if app, ok := a.m[aid]; ok && app.ID == id {
+		s = app.Status
+	}
+	a.mu.RUnlock()
+	return
+}
+
+func (a *Approver) Update(aid string, s Status) {
+	a.mu.Lock()
+	if _, ok := a.m[aid]; ok {
+		a.m[aid].Status = s
+	}
+	a.mu.Unlock()
+}
+
+type Approval struct {
+	ID      string
+	Name    string
+	Created int64
+	Status  Status
+}
+
+type Status int
+
+const (
+	Pending Status = iota
+	Approved
+	Rejected
+)
+
+func (s Status) String() string {
+	switch s {
+	case Pending:
+		return "pending"
+	case Approved:
+		return "approved"
+	case Rejected:
+		return "rejected"
+	}
+	return "[invalid]"
+}
+
+type Route struct {
+	Path    string
+	Handler CtxHandler
+	Methods []string
+}

pkg/api/types/context.go

@@ -0,0 +1,138 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package types
+
+import (
+	"encoding/json"
+	"io"
+	"net"
+	"net/http"
+
+	"github.com/go-logr/logr"
+	"github.com/gorilla/mux"
+
+	"git.giftfish.de/ston1th/keyctl/pkg/db"
+)
+
+type ContextData struct {
+	DB *db.DB
+}
+
+func NewContext(w http.ResponseWriter, r *http.Request, data *ContextData, log logr.Logger) *Context {
+	h := w.Header()
+	h.Set("Content-Type", "application/json")
+	return &Context{
+		Code:     http.StatusOK,
+		Request:  r,
+		Response: w,
+		Data:     data,
+		Log:      log,
+	}
+}
+
+// Context is the context object shared between http handlers
+type Context struct {
+	Code int
+
+	Request  *http.Request
+	Response http.ResponseWriter
+
+	Data *ContextData
+	Log  logr.Logger
+}
+
+// Method returns the request method
+func (c *Context) Method() string {
+	return c.Request.Method
+}
+
+// Path returns the request URL path
+func (c *Context) Path() string {
+	return c.Request.URL.Path
+}
+
+// Header returns the given http header
+func (c *Context) Header(name string) string {
+	return c.Request.Header.Get(name)
+}
+
+// SetHeader sets the given http header
+func (c *Context) SetHeader(name, value string) {
+	h := c.Response.Header()
+	h.Set(name, value)
+}
+
+// Form returns the given form value
+func (c *Context) Form(name string) string {
+	return c.Request.FormValue(name)
+}
+
+func (c *Context) ClientIP() (host string) {
+	host, _, _ = net.SplitHostPort(c.Request.RemoteAddr)
+	return
+}
+
+// Var returns the given url variable
+func (c *Context) Var(name string) (ret string) {
+	ret, _ = mux.Vars(c.Request)[name]
+	return
+}
+
+func (c *Context) log() {
+	c.Log.Info("access",
+		"addr", c.Request.RemoteAddr,
+		"method", c.Request.Method,
+		"path", c.Request.URL.Path,
+		"code", c.Code,
+	)
+}
+
+func (c *Context) NotFound() {
+	c.Err(ErrNotFound)
+}
+
+// OK is a empty HTTP 200 JSON response
+func (c *Context) OK() {
+	c.log()
+}
+
+func (c *Context) ReadBody() (b []byte, err error) {
+	b, err = io.ReadAll(c.Request.Body)
+	c.Request.Body.Close()
+	return
+}
+
+func (c *Context) Body(b []byte) {
+	c.Response.Write(b)
+	c.log()
+}
+
+// JSON is a json response
+func (c *Context) JSON(v any) {
+	err := json.NewEncoder(c.Response).Encode(v)
+	if err != nil {
+		c.Err(ErrISE)
+		return
+	}
+	c.log()
+}
+
+func (c *Context) Redirect(url string, code int) {
+	c.Code = code
+	http.Redirect(c.Response, c.Request, url, code)
+	c.log()
+}
+
+// Err is a HTTPErr wrapper for the custom Error type
+func (c *Context) Err(err Error) {
+	c.HTTPErr(err.JSON(), err.Code())
+}
+
+// HTTPErr is a http.Error wrapper
+func (c *Context) HTTPErr(err string, code int) {
+	c.Code = code
+	http.Error(c.Response, err, code)
+	c.log()
+}
+
+type CtxHandler func(*Context)

pkg/api/types/error.go

@@ -0,0 +1,55 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package types
+
+import (
+	"net/http"
+	"strconv"
+)
+
+// Error interface is a custom api error
+type Error interface {
+	Error() string
+	JSON() string
+	Status() int
+}
+
+// Err implements the Error interface
+type Err struct {
+	err    string
+	status int
+}
+
+// Error returns the error string
+func (a Err) Error() string {
+	return a.err
+}
+
+// Error returns the error string as JSON format
+func (a Err) JSON() string {
+	return `{"error":"` + a.err + `","status":` + strconv.Itoa(a.status) + `}`
+}
+
+// Status returns the HTTP status code
+func (a Err) Status() int {
+	return a.status
+}
+
+func newError(err string, status int) Error {
+	return Err{
+		err:    err,
+		status: status,
+	}
+}
+
+var (
+	ErrInvalidAPIRoute  = newError("invalid api route", http.StatusNotFound)
+	ErrBadreq           = newError("bad request", http.StatusBadRequest)
+	ErrForbidden        = newError("forbidden", http.StatusForbidden)
+	ErrNotFound         = newError("not found", http.StatusNotFound)
+	ErrKeyNotFound      = newError("key not found", http.StatusNotFound)
+	ErrReqNotFound      = newError("key request not found", http.StatusNotFound)
+	ErrTooManyApprovals = newError("too many approvals pending", http.StatusConflict)
+	ErrMNA              = newError("method not allowed", http.StatusMethodNotAllowed)
+	ErrISE              = newError("internal server error", http.StatusInternalServerError)
+)

pkg/api/types/types.go

@@ -0,0 +1,9 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package types
+
+type Route struct {
+	Path    string
+	Handler CtxHandler
+	Methods []string
+}

pkg/api/v1/client/client.go

@@ -0,0 +1,100 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	apiclient "git.giftfish.de/ston1th/keyctl/pkg/api/client"
+	"git.giftfish.de/ston1th/keyctl/pkg/api/v1/schema"
+)
+
+var (
+	ErrClientIsNil = errors.New("client is nil")
+	base           = schema.LBPath
+)
+
+type Client struct {
+	c *apiclient.Client
+}
+
+func NewClient(c *apiclient.Client) (*Client, error) {
+	if c == nil {
+		return nil, ErrClientIsNil
+	}
+	return &Client{c}, nil
+}
+
+func (c *Client) GetLoadBalancers(ctx context.Context) (lbs map[string]*schema.LoadBalancer, err error) {
+	return c.GetLoadBalancersWithCluster(ctx, "")
+}
+
+func (c *Client) GetLoadBalancersWithCluster(ctx context.Context, cluster string) (lbs map[string]*schema.LoadBalancer, err error) {
+	path := base
+	if cluster != "" {
+		path += "/" + cluster
+	}
+	req, err := c.c.NewRequest(ctx, "GET", path, nil)
+	if err != nil {
+		return
+	}
+	lbs = make(map[string]*schema.LoadBalancer)
+	_, err = c.c.Do(req, &lbs)
+	return
+}
+
+func (c *Client) GetLoadBalancer(ctx context.Context, cluster, name string) (lb *schema.LoadBalancer, err error) {
+	path := fmt.Sprintf("%s/%s/%s", base, cluster, name)
+	req, err := c.c.NewRequest(ctx, "GET", path, nil)
+	if err != nil {
+		return
+	}
+	_, err = c.c.Do(req, &lb)
+	return
+}
+
+func (c *Client) CreateLoadBalancer(ctx context.Context, cluster, name string, lb *schema.LoadBalancer) (err error) {
+	buf := new(bytes.Buffer)
+	path := fmt.Sprintf("%s/%s/%s", base, cluster, name)
+	err = lb.ValidateClient()
+	if err != nil {
+		return
+	}
+	err = json.NewEncoder(buf).Encode(lb)
+	if err != nil {
+		return
+	}
+	req, err := c.c.NewRequest(ctx, "POST", path, buf)
+	if err != nil {
+		return
+	}
+	_, err = c.c.Do(req, nil)
+	return
+}
+
+func (c *Client) DeleteLoadBalancer(ctx context.Context, cluster, name string) (err error) {
+	path := fmt.Sprintf("%s/%s/%s", base, cluster, name)
+	req, err := c.c.NewRequest(ctx, "DELETE", path, nil)
+	if err != nil {
+		return
+	}
+	_, err = c.c.Do(req, nil)
+	return
+}
+
+func (c *Client) DeleteLoadBalancersWithCluster(ctx context.Context, cluster string) (err error) {
+	if cluster == "" {
+		return errors.New("cluster value can not be empty")
+	}
+	path := base + "/" + cluster
+	req, err := c.c.NewRequest(ctx, "DELETE", path, nil)
+	if err != nil {
+		return
+	}
+	_, err = c.c.Do(req, nil)
+	return
+}

pkg/api/v1/schema/schema.go

@@ -0,0 +1,95 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package schema
+
+import (
+	"errors"
+
+	"git.giftfish.de/ston1th/keyctl/pkg/api/types"
+	"git.giftfish.de/ston1th/keyctl/pkg/core"
+	"golang.org/x/exp/slices"
+)
+
+const (
+	Version = "v1"
+	KeyName = "key"
+	ReqName = "req"
+	KeyPath = "/" + Version + "/" + KeyName
+	ReqPath = "/" + Version + "/" + ReqName
+)
+
+type NewKey struct {
+	Name     string        `json:"name"`
+	Size     int           `json:"size"`
+	Encoding core.Encoding `json:"encoding"`
+}
+
+var (
+	ErrInvalidKeyName = errors.New("invalid key name")
+	ErrInvalidKeySize = errors.New("invalid key size")
+)
+
+const (
+	MinKeySize = 1
+	MaxKeySize = 1024
+)
+
+func (nk NewKey) Validate() error {
+	if core.NameRe.MatchString(nk.Name) {
+		return ErrInvalidKeyName
+	}
+	if nk.Size > MaxKeySize || nk.Size < MinKeySize {
+		return ErrInvalidKeySize
+	}
+	return nil
+}
+
+func ApproveURL(id, aid string) string {
+	return KeyPath + "/" + id + "/" + aid
+}
+
+type Key struct {
+	ID       string        `json:"id"`
+	Name     string        `json:"name"`
+	Created  int64         `json:"created"`
+	Size     int           `json:"size"`
+	Encoding core.Encoding `json:"encoding"`
+	Key      string        `json:"key"`
+}
+
+type Keys []Key
+
+func (Keys) Less(a, b Key) { return a.Name < b.Name }
+func (k Keys) Sort()       { slices.SortStableFunc(k, k.Less) }
+
+func NewKeys(keys core.Keys) (k Keys) {
+	k = Keys(keys)
+	k.Sort()
+}
+
+type Approval struct {
+	ID      string       `json:"id"`
+	AID     string       `json:"aid"`
+	Name    string       `json:"name"`
+	Created int64        `json:"created"`
+	Status  types.Status `json:"status"`
+}
+
+type Approvals []Approval
+
+func (Approvals) Less(a, b Approval) { return a.Name < b.Name }
+func (a Approvals) Sort()            { slices.SortStableFunc(a, a.Less) }
+
+func NewApprovals(m types.ApprovalMap) (a Approvals) {
+	for k, v := range m {
+		a = append(a, Approval{
+			ID:      v.ID,
+			AID:     k,
+			Name:    v.Name,
+			Created: v.Created,
+			Status:  v.Status,
+		})
+	}
+	a.Sort()
+	return
+}

pkg/api/v1/server/handler.go

@@ -0,0 +1,136 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/netip"
+
+	"git.giftfish.de/ston1th/keyctl/pkg/api/types"
+	"git.giftfish.de/ston1th/keyctl/pkg/api/v1/schema"
+)
+
+func local(h types.CtxHandler) types.CtxHandler {
+	return func(ctx *types.Context) {
+		addr, err := netip.ParseAddr(ctx.ClientIP())
+		if err != nil {
+			ctx.Err(types.ErrForbidden)
+			return
+		}
+		if !addr.IsLoopback() {
+			ctx.Err(types.ErrForbidden)
+			return
+		}
+		h(ctx)
+	}
+}
+
+func healthzHandler(ctx *types.Context) {
+	ctx.OK()
+}
+
+func newHandler(ctx *types.Context) {
+	if ctx.Method() == "POST" {
+		b, err := ctx.ReadBody()
+		if err != nil {
+			ctx.Log.Error(err, "error reading request body")
+			ctx.Err(types.ErrISE)
+			return
+		}
+		var newKey schema.NewKey
+		err = json.Unmarshal(b, &newKey)
+		if err != nil {
+			ctx.Log.Error(err, "error decoding request body")
+			ctx.Err(types.ErrInvalid)
+			return
+		}
+		err = newKey.Validate()
+		if err != nil {
+			ctx.Log.Error(err, "error empty name for new key")
+			ctx.Err(types.ErrInvalid)
+			return
+		}
+		key, err := ctx.Data.DB.CreateKey(newKey.Name, newKey.Size, newKey.Encoding)
+		if err != nil {
+			ctx.Log.Error(err, "error writing loadbalancer", "cluster", cl, "name", n)
+			ctx.Err(types.ErrISE)
+			return
+		}
+		ctx.JSON(schema.Key(key))
+	}
+}
+
+func keyHandler(ctx *types.Context) {
+	id := ctx.Var("id")
+	k, err := ctx.Data.DB.GetKey(id)
+	if err != nil {
+		//TODO error 404
+		ctx.Log.Error(err, "error reading key", "id", id)
+		ctx.Err(types.ErrISE)
+		return
+	}
+	switch ctx.Method() {
+	case "GET":
+		aid := ctx.Var("aid")
+		if aid == "" {
+			aid, err = ctx.Data.Approvals.New(id, k.Name)
+			if err != nil {
+				ctx.Log.Error(err, "error creating approval", "id", id, "name", k.Name)
+				ctx.Err(types.ErrISE)
+				return
+			}
+			ctx.Redirect(schema.ApproveURL(id, aid), http.StatusFound)
+			return
+		}
+		if !ctx.Data.Approvals.Approved(id, aid) {
+			ctx.Redirect(schema.ApproveURL(id, aid), http.StatusFound)
+			return
+		}
+		k, err := ctx.Data.DB.GetKeyWithSecret(id)
+		if err != nil {
+			//TODO error 404
+			ctx.Log.Error(err, "error reading key", "id", id)
+			ctx.Err(types.ErrISE)
+			return
+		}
+		ctx.JSON(schema.Key(k))
+	case "DELETE":
+		err = ctx.Data.DB.DeleteKey(id)
+		if err != nil {
+			ctx.Log.Error(err, "error deleting key", "id", id, "name", k.Name)
+			ctx.Err(types.ErrISE)
+			return
+		}
+		ctx.OK()
+	}
+}
+
+func reqListHandler(ctx *types.Context) {
+	l := ctx.Data.Approvals.List()
+	ctx.JSON(schema.NewApprovals(l))
+}
+
+func keyListHandler(ctx *types.Context) {
+	k, err := ctx.Data.DB.GetKeys()
+	if err != nil {
+		//TODO error 404
+		ctx.Log.Error(err, "error reading keys")
+		ctx.Err(types.ErrISE)
+		return
+	}
+	ctx.JSON(schema.NewKeys(k))
+}
+
+func reqHandler(ctx *types.Context) {
+	id := ctx.Var("id")
+	status := types.Pending
+	switch ctx.Method() {
+	case "PUT":
+		status = types.Approved
+	case "DELETE":
+		status = types.Rejected
+	}
+	ctx.Data.Approvals.Update(id, status)
+	ctx.OK()
+}

pkg/api/v1/server/routes.go

@@ -0,0 +1,59 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package server
+
+import (
+	"git.giftfish.de/ston1th/keyctl/pkg/api/types"
+	"git.giftfish.de/ston1th/keyctl/pkg/api/v1/schema"
+	"git.giftfish.de/ston1th/keyctl/pkg/core"
+)
+
+const (
+	healthz  = "/healthz"
+	keyID    = schema.KeyPath + core.IDRoute
+	keyReqID = schema.KeyPath + core.IDRoute + core.AIDRoute
+	reqID    = schema.ReqPath + core.IDRoute
+)
+
+var Routes = []types.Route{
+	{
+		healthz,
+		healthzHandler,
+		[]string{"GET"},
+	},
+	{
+		schema.KeyPath,
+		local(keyListHandler),
+		[]string{"GET"},
+	},
+	{
+		schema.KeyPath,
+		local(newHandler),
+		[]string{"POST"},
+	},
+	{
+		keyID,
+		keyHandler,
+		[]string{"GET"},
+	},
+	{
+		keyReqID,
+		keyHandler,
+		[]string{"GET"},
+	},
+	{
+		keyID,
+		local(keyHandler),
+		[]string{"DELETE"},
+	},
+	{
+		schema.ReqPath,
+		local(reqListHandler),
+		[]string{"GET"},
+	},
+	{
+		reqID,
+		local(reqHandler),
+		[]string{"PUT", "DELETE"},
+	},
+}

pkg/cli/cli.go

@@ -0,0 +1,3 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package cli

pkg/core/encoding.go

@@ -0,0 +1,56 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package core
+
+import (
+	"encoding/base32"
+	"encoding/base64"
+	"encoding/hex"
+)
+
+var b32raw = base32.StdEncoding.WithPadding(base32.NoPadding)
+
+type Encoding int
+
+func (e Encoding) String() string {
+	switch e {
+	case Base32:
+		return "base32"
+	case Base64:
+		return "base64"
+	case Base64URL:
+		return "base64url"
+	}
+	return "hex"
+}
+
+func (e Encoding) EncodeToString(src []byte) string {
+	switch e {
+	case Base32:
+		return b32raw.EncodeToString(src)
+	case Base64:
+		return base64.RawStdEncoding.EncodeToString(src)
+	case Base64URL:
+		return base64.RawURLEncoding.EncodeToString(src)
+	}
+	return hex.EncodeToString(src)
+}
+
+func EncodingFromString(e string) Encoding {
+	switch e {
+	case "base32":
+		return Base32
+	case "base64":
+		return Base64
+	case "base64url":
+		return Base64URL
+	}
+	return Hex
+}
+
+const (
+	Hex Encoding = iota
+	Base32
+	Base64
+	Base64URL
+)

pkg/core/key.go

@@ -0,0 +1,26 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package core
+
+import "regexp"
+
+const (
+	re            = "a-zA-Z0-9_-"
+	id            = "[a-f0-9]{32}"
+	nameReReverse = "[^" + re + "]+"
+	IDRoute       = "/{id:" + id + "}"
+	AIDRoute      = "/{aid:" + id + "}"
+)
+
+var NameRe = regexp.MustCompile(nameReReverse)
+
+type Key struct {
+	ID       string
+	Name     string
+	Created  int64
+	Size     int
+	Encoding Encoding
+	Key      string
+}
+
+type Keys []Key

pkg/db/db.go

@@ -0,0 +1,53 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package db
+
+import (
+	"io"
+	"path/filepath"
+
+	"git.giftfish.de/ston1th/godrop/v2"
+	"git.giftfish.de/ston1th/keyctl/pkg/core"
+	"git.giftfish.de/ston1th/keyctl/pkg/store"
+	"github.com/go-logr/logr"
+)
+
+const storeFile = "store.db"
+
+type DB struct {
+	log   logr.Logger
+	store store.Store
+}
+
+func NewPlain(log logr.Logger, cfg *core.Config) (db *DB, err error) {
+	db = &DB{log: log}
+	dbFile := filepath.Join(cfg.DataDir, storeFile)
+	err = godrop.Unveil(dbFile, "rwc")
+	if err != nil {
+		return
+	}
+	db.store, err = store.NewBoltStore(dbFile, nil)
+	return
+}
+
+func New(log logr.Logger, cfg *core.Config) (db *DB, err error) {
+	db, err = NewPlain(log, cfg)
+	if err != nil {
+		return
+	}
+
+	err = db.RunMigrations()
+	return
+}
+
+func (db *DB) Dump(w io.Writer) error {
+	return db.store.Dump(w)
+}
+
+func (db *DB) Restore(r io.Reader) error {
+	return db.store.Restore(r)
+}
+
+func (db *DB) Close() error {
+	return db.store.Close()
+}

pkg/db/key.go

@@ -0,0 +1,48 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package db
+
+import (
+	"sort"
+
+	"git.giftfish.de/ston1th/goacc/pkg/core"
+	"git.giftfish.de/ston1th/keyctl/pkg/key"
+)
+
+const keyPrefix = "key/"
+
+func (db *DB) GetKeys() (keys core.Keys, err error) {
+	err = db.store.ForEachPrefix(keyPrefix, func(k string, _ []byte) error {
+		k, err := db.GetKey(k)
+		if err == nil {
+			keys = append(keys, k)
+		}
+		return nil
+	})
+	sort.Sort(keys)
+	return
+}
+
+func (db *DB) GetKey(id string) (k core.Key, err error) {
+	k, err = db.GetKeyWithSecret(id)
+	k.Key = ""
+	return
+}
+
+func (db *DB) GetKeyWithSecret(id string) (k core.Key, err error) {
+	err = db.store.Get(keyPrefix+id, &k)
+	return
+}
+
+func (db *DB) CreateKey(name string, size int, enc core.Encoding) (k core.Key, err error) {
+	k, err = key.Generate(name, size, enc)
+	if err != nil {
+		return
+	}
+	err = db.store.Set(keyPrefix+k.ID, &k)
+	return
+}
+
+func (db *DB) DeleteKey(id string) error {
+	return db.store.Delete(keyPrefix + id)
+}

pkg/db/migration.go

@@ -0,0 +1,60 @@
+// Copyright (C) 2022 Marius Schellenberger
+
+package db
+
+import (
+	"errors"
+
+	"git.giftfish.de/ston1th/keyctl/pkg/store"
+)
+
+const (
+	versionKey     = "version/version"
+	currentVersion = 0
+)
+
+type migrator func(*DB, int) error
+
+var migrators = []migrator{
+	func(_ *DB, _ int) error {
+		return nil
+	},
+}
+
+func (db *DB) RunMigrations() (err error) {
+	log := db.log.WithName("migration")
+	var version int
+	err = db.store.Get(versionKey, &version)
+	if err == store.ErrKeyNotFound {
+		err = db.store.Set(versionKey, currentVersion)
+		if err != nil {
+			return
+		}
+		err = db.store.Get(versionKey, &version)
+		if err != nil {
+			return
+		}
+	}
+	log.Info("db versions", "current", version, "new", currentVersion)
+	if currentVersion < version {
+		return errors.New("incompatible versions")
+	}
+	if currentVersion == version {
+		log.Info("nothing to do")
+	}
+	for version < currentVersion {
+		v := version + 1
+		log.Info("running", "version", v)
+		err = migrators[v](db, v)
+		if err != nil {
+			return
+		}
+		err = db.store.Set(versionKey, v)
+		if err != nil {
+			return
+		}
+		version = v
+		log.Info("finished", "version", v)
+	}
+	return
+}

pkg/key/key.go

@@ -0,0 +1,48 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package key
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"io"
+	"time"
+
+	"git.giftfish.de/ston1th/keyctl/pkg/core"
+)
+
+const idSize = 16
+
+func generate(size int) (buf []byte, err error) {
+	buf = make([]byte, size)
+	_, err = io.ReadFull(rand.Reader, buf)
+	return
+}
+
+func GenerateID() (string, error) {
+	id, err := generate(idSize)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(id), nil
+}
+
+func Generate(name string, size int, enc core.Encoding) (k core.Key, err error) {
+	id, err := GenerateID()
+	if err != nil {
+		return
+	}
+	key, err := generate(size)
+	if err != nil {
+		return
+	}
+	k = core.Key{
+		Name:     name,
+		ID:       id,
+		Size:     size,
+		Encoding: enc.String(),
+		Key:      enc.Encode(key),
+		Created:  time.Now().Unix(),
+	}
+	return
+}

pkg/store/boltstore.go

@@ -0,0 +1,140 @@
+// Copyright (C) 2022 Marius Schellenberger
+
+package store
+
+import (
+	"encoding/json"
+	"io"
+
+	bolt "go.etcd.io/bbolt"
+)
+
+const (
+	defaultBoltBucket = "default"
+	fileMode          = 0o600
+)
+
+type BoltStore struct {
+	Marshaler
+	db *bolt.DB
+}
+
+func NewBoltStore(file string, m Marshaler) (Store, error) {
+	if m == nil {
+		m = NewGOB()
+	}
+	db, err := bolt.Open(file, fileMode, nil)
+	if err != nil {
+		return nil, err
+	}
+	if err := db.Update(func(tx *bolt.Tx) (err error) {
+		_, err = tx.CreateBucketIfNotExists([]byte(defaultBoltBucket))
+		return
+	}); err != nil {
+		return nil, err
+	}
+	return &BoltStore{m, db}, nil
+}
+
+type dump struct {
+	K string `json:"k"`
+	V []byte `json:"v"`
+}
+
+func (bs *BoltStore) Dump(w io.Writer) (err error) {
+	if w == nil {
+		return ErrWriterIsNil
+	}
+	var d []dump
+	err = bs.ForEach(func(k string, v []byte) error {
+		b := make([]byte, len(v))
+		copy(b, v)
+		d = append(d, dump{k, b})
+		return nil
+	})
+	if err != nil {
+		return
+	}
+	return json.NewEncoder(w).Encode(d)
+}
+
+func (bs *BoltStore) Restore(r io.Reader) (err error) {
+	if r == nil {
+		return ErrReaderIsNil
+	}
+	var d []dump
+	err = json.NewDecoder(r).Decode(&d)
+	if err != nil {
+		return
+	}
+	if err = bs.db.Update(func(tx *bolt.Tx) (err error) {
+		if err = tx.DeleteBucket([]byte(defaultBoltBucket)); err != nil {
+			return
+		}
+		_, err = tx.CreateBucket([]byte(defaultBoltBucket))
+		return
+	}); err != nil {
+		return
+	}
+	return bs.db.Update(func(tx *bolt.Tx) (err error) {
+		b := tx.Bucket([]byte(defaultBoltBucket))
+		for _, v := range d {
+			b.Put([]byte(v.K), v.V)
+		}
+		return nil
+	})
+}
+
+func (bs *BoltStore) Get(key string, v interface{}) (err error) {
+	err = bs.db.View(func(tx *bolt.Tx) error {
+		b := tx.Bucket([]byte(defaultBoltBucket)).Get([]byte(key))
+		if b == nil {
+			return ErrKeyNotFound
+		}
+		if v != nil {
+			return bs.Unmarshal(b, v)
+		}
+		return nil
+	})
+	return
+}
+
+func (bs *BoltStore) Set(key string, v interface{}) error {
+	return bs.db.Update(func(tx *bolt.Tx) (err error) {
+		var b []byte
+		if v != nil {
+			b, err = bs.Marshal(v)
+			if err != nil {
+				return
+			}
+		}
+		return tx.Bucket([]byte(defaultBoltBucket)).Put([]byte(key), b)
+	})
+}
+
+func (bs *BoltStore) ForEach(f func(string, []byte) error) error {
+	return bs.db.View(func(tx *bolt.Tx) error {
+		return tx.Bucket([]byte(defaultBoltBucket)).ForEach(func(k, v []byte) error {
+			return f(string(k), v)
+		})
+	})
+}
+
+func (bs *BoltStore) ForEachPrefix(prefix string, f func(string, []byte) error) error {
+	return bs.ForEach(func(k string, v []byte) error {
+		if trim, ok := hasTrimPrefix(k, prefix); ok {
+			return f(trim, v)
+		}
+		return nil
+	})
+}
+
+func (bs *BoltStore) Delete(key string) error {
+	return bs.db.Update(func(tx *bolt.Tx) error {
+		return tx.Bucket([]byte(defaultBoltBucket)).Delete([]byte(key))
+	})
+}
+
+func (bs *BoltStore) Close() error {
+	return bs.db.Close()
+}

pkg/store/boltstore_test.go

@@ -0,0 +1,98 @@
+// Copyright (C) 2022 Marius Schellenberger
+
+package store
+
+import (
+	"bytes"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+type testData struct {
+	Data string
+}
+
+func TestBoltStore(t *testing.T) {
+	data := []testData{
+		{"123"},
+		{"hello"},
+	}
+	dir, err := os.MkdirTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
+	bs, err := NewBoltStore(filepath.Join(dir, "bolt.db"), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = bs.Set("key0", data[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = bs.Set("key1", data[1])
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("GetKey0", func(t *testing.T) {
+		var d testData
+		err := bs.Get("key0", &d)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if d != data[0] {
+			t.Error("d is not data[0]")
+		}
+	})
+	t.Run("ForEach", func(t *testing.T) {
+		err := bs.ForEach(func(k string, v []byte) error {
+			if k == "key0" || k == "key1" {
+				return nil
+			}
+			return errors.New("key0 or key1 not found")
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	})
+	t.Run("DumpRestore", func(t *testing.T) {
+		buf := new(bytes.Buffer)
+		err := bs.Dump(buf)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if buf.Len() == 0 {
+			t.Error("no dump written")
+		}
+		err = bs.Restore(buf)
+		if err != nil {
+			t.Fatal(err)
+		}
+	})
+	t.Run("DeleteKey1", func(t *testing.T) {
+		err := bs.Delete("key1")
+		if err != nil {
+			t.Fatal(err)
+		}
+	})
+	t.Run("GetKey1", func(t *testing.T) {
+		var d testData
+		err := bs.Get("key1", &d)
+		if err == nil {
+			t.Error("key1 should be deleted")
+		}
+		if d == data[1] {
+			t.Error("d is not data[1]")
+		}
+	})
+	t.Run("Close", func(t *testing.T) {
+		err := bs.Close()
+		if err != nil {
+			t.Fatal(err)
+		}
+	})
+}

pkg/store/dump.go

@@ -0,0 +1,13 @@
+// Copyright (C) 2022 Marius Schellenberger
+
+package store
+
+import "io"
+
+type Dumper interface {
+	Dump(io.Writer) error
+}
+
+type Restorer interface {
+	Restore(io.Reader) error
+}

pkg/store/gob.go

@@ -0,0 +1,25 @@
+// Copyright (C) 2022 Marius Schellenberger
+
+package store
+
+import (
+	"bytes"
+	"encoding/gob"
+)
+
+type gobMarshaler struct{}
+
+func NewGOB() Marshaler {
+	return gobMarshaler{}
+}
+
+func (gobMarshaler) Marshal(v interface{}) (b []byte, err error) {
+	buf := new(bytes.Buffer)
+	err = gob.NewEncoder(buf).Encode(v)
+	b = buf.Bytes()
+	return
+}
+
+func (gobMarshaler) Unmarshal(data []byte, v interface{}) error {
+	return gob.NewDecoder(bytes.NewBuffer(data)).Decode(v)
+}

pkg/store/helper.go

@@ -0,0 +1,11 @@
+// Copyright (C) 2022 Marius Schellenberger
+
+package store
+
+// Parts taken from strings.TrimPrefix
+func hasTrimPrefix(s, prefix string) (string, bool) {
+	if len(s) >= len(prefix) && s[0:len(prefix)] == prefix {
+		return s[len(prefix):], true
+	}
+	return s, false
+}

pkg/store/marshal.go

@@ -0,0 +1,8 @@
+// Copyright (C) 2022 Marius Schellenberger
+
+package store
+
+type Marshaler interface {
+	Marshal(v interface{}) ([]byte, error)
+	Unmarshal(data []byte, v interface{}) error
+}

pkg/store/store.go

@@ -0,0 +1,23 @@
+// Copyright (C) 2022 Marius Schellenberger
+
+package store
+
+import "errors"
+
+var (
+	ErrKeyNotFound = errors.New("store: key not found")
+	ErrWriterIsNil = errors.New("store: writer is nil")
+	ErrReaderIsNil = errors.New("store: reader is nil")
+)
+
+type Store interface {
+	Marshaler
+	Dumper
+	Restorer
+	Get(string, interface{}) error
+	Set(string, interface{}) error
+	ForEach(func(string, []byte) error) error
+	ForEachPrefix(string, func(string, []byte) error) error
+	Delete(string) error
+	Close() error
+}