undercroft

commit 969794c64d9f90af2ffa9ac007103944a4d995e0
parent bcad262a20061a0fe638397c731a96dbc19c9248
Author: Daniel Barlow <dan@telent.net>
Date:   Sun, 26 Apr 2026 21:03:48 +0100

invoke sops

Diffstat:
M
Makefile
 | 
12
++++++++++--
A
example-secrets.yaml
 | 
9
+++++++++
M
rustup.nix
 | 
2
++
M
src/main.rs
 | 
29
+++++++++++++++++++++++++----

4 files changed, 46 insertions(+), 6 deletions(-)
diff --git a/Makefile b/Makefile
@@ -20,8 +20,16 @@ certs/%.csr:
 certs/%.crt: certs/%.csr private/ca.key
 	openssl x509 -req -in $< -days 365 -CA certs/ca.crt -CAkey private/ca.key -CAcreateserial -copy_extensions copyall -out $@
 
-run: certificates
-	cargo run -- --ca-certificate certs/ca.crt --certificate certs/server.crt --key private/server.key --port $(SERVERPORT) secrets.yml.age
+run: certificates example-secrets.enc.yaml
+	cargo run -- --ca-certificate certs/ca.crt --certificate certs/server.crt --key private/server.key --port $(SERVERPORT) example-secrets.enc.yaml
 
 ping:
 	curl --connect-to ::127.0.0.1:3002  --cert certs/client.crt --key private/client.key --cacert certs/ca.crt -v https://${SERVERNAME}:$(SERVERPORT)
+
+private/age.key:
+	age-keygen -o $@
+
+example-secrets.enc.yaml:  example-secrets.yaml private/age.key
+	sops encrypt \
+	 --age $$(age-keygen -y < private/age.key) \
+	 $< > $$$$ && mv $$$$  $@
diff --git a/example-secrets.yaml b/example-secrets.yaml
@@ -0,0 +1,9 @@
+wireless:
+    myssid:
+        password: horse stapled
+        channel: 4
+users:
+    backup:
+        password: correct battery
+        uid: 502
+        gecos: Backup user
diff --git a/rustup.nix b/rustup.nix
@@ -13,6 +13,8 @@
   pkgs.mkShell rec {
     nativeBuildInputs= with pkgs; [
       openssl
+      rustup
+      sops
     ];
     buildInputs = with pkgs; [
       clang
diff --git a/src/main.rs b/src/main.rs
@@ -1,8 +1,14 @@
 
-use axum::{extract::Request, routing::get, Router};
+use axum::{
+    extract::Request,
+    routing::get, Router,
+    http::StatusCode
+};
 use std::sync::Arc;
 use std::net::SocketAddr;
 
+use std::process::Command;
+
 use hyper::body::Incoming;
 use hyper_util::rt::{TokioExecutor, TokioIo};
 use tokio::net::TcpListener;
@@ -38,8 +44,22 @@ struct Cli {
     secrets: String
 }
 
-// decrypt sops file
-// serve it
+
+async fn send_it(secrets_path : String) -> (StatusCode, String) {
+    let output = Command::new("sops")
+	.arg("decrypt")
+	.arg(secrets_path)
+	.output()
+	.expect("failed to execute process");
+
+    if output.status.success() {
+	(StatusCode::OK, String::from_utf8(output.stdout).expect("bad utf8"))
+    } else {
+	(StatusCode::INTERNAL_SERVER_ERROR, String::from_utf8(output.stderr).expect("bad utf8"))
+    }
+
+}
+
 
 #[tokio::main]
 async fn main() {
@@ -85,7 +105,8 @@ async fn main() {
 
     println!("listening on {}", addr);
 
-    let app = Router::new().route("/", get(|| async { "Hello, world!" }));
+    let handler = move || send_it(cli.secrets) ;
+    let app = Router::new().route("/", get(handler));
 
     loop {
         let tower_service = app.clone();