{"id":51462577,"url":"https://github.com/codenlighten/smart-kms","last_synced_at":"2026-07-06T07:01:15.249Z","repository":{"id":364044155,"uuid":"1045339943","full_name":"codenlighten/smart-kms","owner":"codenlighten","description":"AWS smart-kms BSV key mgmt","archived":false,"fork":false,"pushed_at":"2026-06-11T11:03:33.000Z","size":271,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-11T13:06:57.045Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/codenlighten.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-08-27T02:34:02.000Z","updated_at":"2026-06-11T11:03:38.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/codenlighten/smart-kms","commit_stats":null,"previous_names":["codenlighten/smart-kms"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/codenlighten/smart-kms","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codenlighten%2Fsmart-kms","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codenlighten%2Fsmart-kms/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codenlighten%2Fsmart-kms/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codenlighten%2Fsmart-kms/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/codenlighten","download_url":"https://codeload.github.com/codenlighten/smart-kms/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codenlighten%2Fsmart-kms/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35180933,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-06T02:00:07.184Z","response_time":106,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-06T07:01:14.143Z","updated_at":"2026-07-06T07:01:15.223Z","avatar_url":"https://github.com/codenlighten.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# SmartKMS — Universal Foundation (AWS KMS Scaffold)\n\n**Production-grade signing platform for BSV and Web3**, powered by AWS KMS (secp256k1), multi-tenant policies, DynamoDB receipts, and a NAT-less ECS Fargate deployment behind an ALB.\n\n- **API**: `https://api.smartkms.com/v1`\n- **Status**: Production-deployed (ECS Fargate, NAT-less with VPC Endpoints)\n- **License**: Apache-2.0\n\n## 🚦 Current Status\n\n**Infrastructure**: ✅ 100% Operational  \n**API Health**: ✅ 150ms avg response  \n**Security**: ✅ API Key authentication enabled  \n**Monitoring**: ✅ CloudWatch active  \n**Signing**: ✅ Hardware-backed KMS operational\n\n\u003e **Production Ready**: The system is fully operational with enterprise-grade API key authentication, hardware-backed signing, and 99.2% uptime. See [TEAM_DOCUMENTATION.md](TEAM_DOCUMENTATION.md) for complete team guide.\n\n## Features\n- 🔐 **Hardware-backed signing** via AWS KMS (ES256K / secp256k1)\n- 🔑 **API Key authentication** with role-based access control\n- 🧩 **Multi-tenant isolation** (per-tenant key aliases \u0026 policies)\n- 📜 **Receipts / audit trail** in DynamoDB\n- 📈 **Admin UI** (Vue 3) for health, keys, and stats\n- 🛡️ **NAT-less ECS** with ECR/S3/STS/KMS/ECS/Logs endpoints\n- 📦 **Terraform modules** for networking, ECS service, monitoring\n\n---\n\n## Documentation\n\n- **[📋 Complete Team Guide](TEAM_DOCUMENTATION.md)** - Comprehensive documentation for development teams\n- **[🔧 Developer API Guide](DEVELOPER_API_GUIDE.md)** - Complete API reference and integration examples\n- **[📊 Project Status](PROJECT_STATUS.md)** - Current status and metrics\n- **[🛡️ Security Guidelines](SECURITY.md)** - Security best practices\n- **[🤝 Contributing](CONTRIBUTING.md)** - Development guidelines\n\n---\n\n## Repo Layout\n```\n/admin-ui/                 # Vue 3 dashboard\n/services/sign-service/    # Node.js/TS signing API\n/infra/terraform/          # Reference stack (legacy)\n/modules/                  # Reusable Terraform (nat-less, ecs_service, monitoring)\n/api/schemas/              # JSON Schemas\n/docs/                     # OpenAPI, runbooks, diagrams\n/examples/                 # SDK + Node client\n```\n\n---\n\n## Quick Start (Local Dev)\n\n### 1) Sign Service\n```bash\ncd services/sign-service\ncp .env.example .env\n# set: AWS_REGION, RECEIPTS_TABLE, TENANT_ID, etc.\nnpm i\nnpm run build\nnpm start\n# API on http://localhost:8080/v1\n```\n\n### 2) Admin UI\n```bash\ncd admin-ui\nnpm i\nnpm run dev\n# UI on http://localhost:3000 (proxied to /v1)\n```\n\n---\n\n## Hitting the Cloud API\n\n⚠️ **Authentication Required**: All API endpoints now require API key authentication.\n\n### Health (no auth required)\n```bash\ncurl https://api.smartkms.com/v1/health\n```\n\n### Sign (requires API key)\n```bash\ncurl -X POST https://api.smartkms.com/v1/sign \\\n  -H \"Content-Type: application/json\" \\\n  -H \"X-API-Key: your-api-key-here\" \\\n  -d '{\n    \"tenant\": \"PROD\",\n    \"keyId\": \"anchor\",\n    \"message\": \"Hello Smart KMS!\",\n    \"algorithm\": \"ECDSA_SHA_256\"\n  }'\n```\n\n### Admin endpoints (requires admin API key)\n```bash\ncurl -H \"X-API-Key: admin-key-here\" https://api.smartkms.com/v1/admin/keys\ncurl -H \"X-API-Key: admin-key-here\" https://api.smartkms.com/v1/admin/stats\n```\n\n---\n\n## SDK \u0026 Example Client\n\n**JavaScript/TypeScript SDK** at `/sdk/js` and **Node client** at `/examples/node-client`.\n\n```bash\n# build SDK\ncd sdk/js \u0026\u0026 npm i \u0026\u0026 npm run build\n\n# run example client\ncd ../../examples/node-client\nnpm i\ncp .env.example .env\n# edit TENANT_ID/KEY_ALIAS if needed\nnpm start\n```\n\n---\n\n## Deploying the NAT-less Stack (Terraform modules)\n\nSee `/modules` and `docs/natless-ecs-runbook.md`.\n\nHigh-level:\n\n1. **Networking**: VPC, subnets, SGs, Interface endpoints (ECR api/dkr, ECS, ECS-agent, ECS-telemetry, Logs, KMS, STS), Gateway endpoints (S3, DynamoDB), VPC DNS on.\n2. **ECS Service**: Fargate service + ALB (HTTPS via ACM), task role/execution role (least privilege).\n3. **Monitoring**: CloudWatch Logs, alarms (CPU/mem, target health, 5xx), metric filters for `CannotPullContainerError`.\n\n\u003e Costs (est.): **$70–100/mo** NAT-less (no NAT Gateway).\n\n---\n\n## Security Checklist\n\n* ✅ **API Key authentication** implemented with role-based access control\n* Use **IAM roles** (no long-lived keys) for task execution \u0026 app access.\n* Restrict SG egress to **S3 prefix list** + Interface endpoint SGs.\n* Turn on **CloudTrail** + KMS **key usage logs**.\n* Enable **DynamoDB PITR** for receipts.\n* JWT/API keys on ALB (WAF/Rate limits) for tenant isolation at the edge.\n* ✅ **Authentication errors** (401/403) properly handled\n* ✅ **Admin/User role separation** enforced\n\n---\n\n## API Reference\n\nOpenAPI: `docs/openapi.yaml`\n\nEndpoints:\n\n* `GET /v1/health`\n* `POST /v1/sign`\n* `GET /v1/admin/stats`\n* `GET /v1/admin/keys`\n* *(optional)* `GET /v1/keys/{alias}/public` → `{ compressedHex }`\n\n---\n\n## Contributing\n\nSee [`CONTRIBUTING.md`](CONTRIBUTING.md). Run tests with `npm test`. PRs require passing CI.\n\n---\n\n## License\n\nApache-2.0 © 2025 Codenlighten, Inc.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcodenlighten%2Fsmart-kms","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcodenlighten%2Fsmart-kms","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcodenlighten%2Fsmart-kms/lists"}