{"id":16260012,"url":"https://github.com/cludden/mycro-secrets","last_synced_at":"2025-04-08T13:49:18.061Z","repository":{"id":57306522,"uuid":"51076988","full_name":"cludden/mycro-secrets","owner":"cludden","description":"mycro hook for loading secrets from vault","archived":false,"fork":false,"pushed_at":"2016-07-10T17:14:16.000Z","size":84,"stargazers_count":0,"open_issues_count":2,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-26T13:41:50.142Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cludden.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-02-04T13:16:08.000Z","updated_at":"2016-06-07T01:25:44.000Z","dependencies_parsed_at":"2022-08-28T21:10:19.579Z","dependency_job_id":null,"html_url":"https://github.com/cludden/mycro-secrets","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cludden%2Fmycro-secrets","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cludden%2Fmycro-secrets/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cludden%2Fmycro-secrets/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cludden%2Fmycro-secrets/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cludden","download_url":"https://codeload.github.com/cludden/mycro-secrets/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247451303,"owners_count":20940946,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-10T16:06:03.107Z","updated_at":"2025-04-08T13:49:18.019Z","avatar_url":"https://github.com/cludden.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# mycro-secrets\na [vault](https://github.com/hashicorp/vault) hook for [mycro](https://github.com/cludden/mycro) apps.\n\n\n## Install\nInstall the hook\n```bash\nnpm install --save mycro-secrets\n```\n\nAdd it to hook config before any other hooks\n```javascript\n// in config/hooks.js\nmodule.exports = [\n    'mycro-secrets',\n    // ..\n]\n```\n\n\n## Background\nMost applications require secrets (sensitive data like passwords, api keys, tokens, etc) to interact with other services, databases, and third party apis. Most applications resort to environment variables for storing this sensitive data, but environment variables can become hard to manage and update. [Vault](https://github.com/hashicorp/vault) has proven to be a very elegant tool for managing these secrets. This hook aims to abstract away the logic involved in fetching secrets and provide a simple and declarative api for specifying the required secrets that an app requires before starting.\n\n\n## Process\nThis basic process performed by this hook is described below:\n\n1. Request secret config from DynamoDB\n2. Ensure we understand the config document\n3. Contact vault for all secrets specified in the config document\n4. Validate our secrets object after all requests have been fulfilled successfully\n5. Make secrets available at `mycro.secrets()`\n\n\n## General Usage\n1. define a config table in DynamoDB with hash key of type `string` with name `id`\n2. create an item containing the config for your app\n\n```javascript\n{\n    \"id\": \"my-app-name\",\n    \"secrets\": {\n        \"/cubbyhole/my-app-name\": {\n            \"/bugsnag\": \"bugsnag\",\n            \"/mongo\": \"mongo\",\n            \"/redis\": \"redis\"\n        }\n    },\n    \"vault\": {\n        \"token\": \"\u003cx-vault-token\u003e\",\n        \"test-token\": \"\u003cx-vault-token\u003e\",\n        \"url\": \"https://www.example.com/api/vault/v1\"\n    }\n}\n```\n3. define a hook config file\n\n```javascript\n// in config/secrets.js\nmodule.exports = {\n    attempts: 3,\n    configId: 'my-app-name',\n    interval: '30s',\n    region: 'us-west-2',\n    tableName: 'my-config-table',\n    validate: function(joi) {\n        return joi.object({\n            bugsnag: joi.object({\n                'api-key': joi.string().required()\n            }).required(),\n            mongo: joi.object({\n                url: joi.string().required()\n            }).required(),\n            redis: joi.object({\n                host: joi.string().required(),\n                port: joi.number().integer().default(6379),\n                db: joi.number().integer().default(0)\n            }).required()\n        }).required()\n    }\n}\n```\n4. use your secrets\n\n```javascript\nmycro.secrets();\n// {\n//      \"bugsnag\": {\n//          \"api-key\": \"SKHEOICH2390gvewohEIHCOEH\"\n//      },\n//      \"mongo\": {\n//          \"url\": \"mongodb://admin:password@mongourl:27017/my-db\"\n//      },\n//      \"redis\": {\n//          \"host\": \"redishost\",\n//          \"port\": 6379,\n//          \"db\": 0\n//      }\n// }\n\nmycro.secrets('bugsnag.api-key');\n// SKHEOICH2390gvewohEIHCOEH\n```\n\n\n## API\n#### DynamoDB\nSecret configurations are stored in DynamoDB. The table definition must have a hash key with\nname `id` and type `string`. The config items follow the schema outlined below:\n\n```javascript\n{\n    // the id of the config object\n    \"id\": \"\u003cconfig-id\u003e\",\n\n    // a map of secret urls to request from vault\n    // note: a multi level map will be flattened and\n    // concatenated with the vault url specified below\n    \"secrets\": {\n        \"/cubbhole\": {\n            \"/common\": \"common\",\n            \"/my-service\": {\n                \"/bugsnag\": \"bugsnag\"\n            }\n        }\n    },\n\n    \"vault\": {\n        // OPTIONAL vault token to use in production\n        // note: if a VAULT_TOKEN environment variable is found, it will be used instead\n        \"token\": \"\u003cx-vault-token\u003e\",\n\n        // OPTIONAL vault token to use during tests\n        // note: if a VAULT_TOKEN_TEST environment variable is found, it will be used instead\n        \"test-token\": \"\u003cx-vault-token\u003e\",\n\n        // the vault server endpoint\n        \"url\": \"https://www.example.com/api/vault/v1\"\n    }\n}\n```\n\nUsing the config above, this hook will make the following requests from vault:\n- `GET https://www.example.com/api/vault/v1/cubbyhole/common`\n  - the returned secret will be available at `mycro.secrets('common')`\n- `GET https://www.example.com/api/vault/v1/cubbyhole/my-service/bugsnag`\n  - the returned secret will be available at `mycro.secrets('bugsnag')`\n\n#### Hook Config\nThis hook can be configured by defining a configuration file at `config/secrets.js`. The structure of this file is outlined below:\n\n```javascript\n// in config/secrets.js\nmodule.exports = {\n    // the number of times to attempt to retreive each secret from vault.\n    // if falsey, it will retry indefinitely (default)\n    attempts: 3,\n\n    // the id of the config object to request from DynamoDB\n    configId: 'my-service',\n\n    // how long to wait in between attempts\n    interval: '30s', // can also be an integer representing milliseconds to wait\n\n    // the dynamodb region to request from\n    region: 'us-west-2',\n\n    // the name of the dynamodb table holding config items`\n    tableName: 'my-config-table',\n\n    // a validation function that should return a joi schema that will be\n    // used to validate the fetched secrets\n    validate: function(joi) {\n        return joi.object({\n            // ...\n        }).required()\n    }\n}\n```\n\n## Testing\nRun the test suite:\n```bash\nnpm test\n```\n\nRun coverage:\n```bash\ngrunt coverage\n```\n\n\n## Contributing\n1. [Fork it](https://github.com/cludden/mycro-secrets/fork)\n2. Create your feature branch (`git checkout -b my-new-feature`)\n3. Commit your changes (`git commit -am 'Add some feature'`)\n4. Push to the branch (`git push origin my-new-feature`)\n5. Create new Pull Request\n\n\n## License\nCopyright (c) 2016 Chris Ludden.\nLicensed under the [MIT license](LICENSE.md).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcludden%2Fmycro-secrets","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcludden%2Fmycro-secrets","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcludden%2Fmycro-secrets/lists"}