4d9a26498e
Paste a secret, get a link, send it. The first person to open it and press
Reveal sees the secret; the link dies at that moment. The recipient needs a
browser and nothing else — no account, no client, no installed tooling.
The server cannot read what it stores. AES-256-GCM happens in the browser and
the key lives in the URL fragment, which browsers never transmit, so hushd
holds ciphertext and no key material. That is a property of where the key sits
rather than a promise about our conduct, which is why there is deliberately no
endpoint accepting a plaintext secret and no server-side-encryption fallback:
two guarantees behind one URL would be worse than one honest guarantee.
Three decisions carry the design:
* GET /s/{id} touches NO storage, not even to check existence. Slack, Teams,
WhatsApp, iMessage and Outlook Safe Links all fetch a URL before a human
sees it, so destroying on GET would destroy most secrets in transit and the
recipient's "already used" would be indistinguishable from interception.
Only POST /reveal consumes. Bot user-agent detection is an arms race;
removing the side effect from GET is not. Pinned by
TestGettingTheRevealPageNeverConsumesTheSecret.
* Destruction is one Redis GETDEL, which is atomic. GET-then-DEL has a window
where two simultaneous readers both win, and for a one-time secret that
window is the product. The store contract demands atomicity and the same
concurrency test runs against both implementations.
* Missing, already-revealed, expired and evicted are ONE indistinguishable
410. Separating them would confirm to a prober that a given link was real.
The secret id IS the capability, so secret.ID is a struct whose every
accidental path — %v, %s, String(), slog, json.Marshal — emits a redacted
handle or refuses, and the raw value needs an explicit Value(). The first
version tried to prevent leaks by implementing no String() at all; its own test
caught that Go's fmt prints unexported fields anyway, so forbidding the method
had removed the control rather than the leak.
Operationally: structured JSON on stdout in the fleet's wire format, which
Vector already collects with no annotation; six hush_* metrics on the chassis
registry with no id, IP or path in any label; five alert rules wired into
vmalert. The public Ingress enumerates /, /s/ and /api/ so /metrics, /healthz
and /readyz share the port but are unreachable from the internet — no
basic-auth middleware to maintain and get wrong.
Dependencies are vendored because go-chassis is private: the Woodpecker test
step and the in-cluster Kaniko build both run -mod=vendor with GOPROXY=off and
hold no git credential.
cmd/hush-mcp is a stdio MCP server doing the same client-side crypto locally,
so using hush from an agent preserves the same guarantee as using it from a
browser.
92 lines
3.7 KiB
Makefile
92 lines
3.7 KiB
Makefile
.DEFAULT_GOAL := help
|
|
.PHONY: help fmt vet test test-redis build run dev dev-stop smoke vendor verify ci \
|
|
mcp mcp-install deploy-manifests deploy-status logs alerts-check
|
|
|
|
# Local development Redis. A real server, not a mock: the one-time guarantee
|
|
# rests on GETDEL being atomic, and a fake cannot prove that.
|
|
DEV_REDIS_PORT ?= 6389
|
|
DEV_REDIS_URL ?= redis://127.0.0.1:$(DEV_REDIS_PORT)/5
|
|
HUSH_PORT ?= 18500
|
|
BASE ?= http://127.0.0.1:$(HUSH_PORT)
|
|
|
|
# The public deployment. `hushd` runs one replica in the `projects` namespace.
|
|
KUBECONFIG_FILE ?= $(HOME)/.kube/orchard9-k3sf.yaml
|
|
NS ?= projects
|
|
HOST ?= hush.threesix.ai
|
|
|
|
help: ## Show this help
|
|
@grep -hE '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) \
|
|
| awk 'BEGIN{FS=":.*?## "}{printf " \033[36m%-18s\033[0m %s\n", $$1, $$2}'
|
|
|
|
fmt: ## Format everything outside vendor/
|
|
@gofmt -w ./cmd ./internal
|
|
|
|
vet: ## go vet
|
|
@go vet ./...
|
|
|
|
test: ## Unit tests. No Redis, no network, no container.
|
|
@go test ./...
|
|
|
|
test-redis: ## Run the store contract suite against a REAL Redis as well
|
|
@$(MAKE) --no-print-directory dev-redis
|
|
@HUSH_TEST_REDIS_URL=$(DEV_REDIS_URL) go test ./internal/store/... -count=1
|
|
|
|
build: ## Build both binaries into .build/
|
|
@mkdir -p .build
|
|
@go build -o .build/hushd ./cmd/hushd
|
|
@go build -o .build/hush-mcp ./cmd/hush-mcp
|
|
|
|
# `vendor` is not a convenience: github.com/orchard9/go-chassis is a PRIVATE
|
|
# module, so neither the Woodpecker test step nor the in-cluster Kaniko build
|
|
# can fetch it. Vendoring makes both hermetic — they build with -mod=vendor and
|
|
# no network and no credential. This target is the only way dep versions move.
|
|
vendor: ## Refresh vendor/ after a dependency change
|
|
@GOPRIVATE=github.com/orchard9 go mod tidy
|
|
@GOPRIVATE=github.com/orchard9 go mod vendor
|
|
@go build -mod=vendor ./... && echo "vendor/ builds hermetically"
|
|
|
|
verify: ## Prove the vendored tree builds with no network, exactly as CI does
|
|
@GOFLAGS=-mod=vendor GOPROXY=off go build ./... \
|
|
&& GOFLAGS=-mod=vendor GOPROXY=off go test ./... >/dev/null \
|
|
&& echo "hermetic build OK (GOPROXY=off, -mod=vendor)"
|
|
|
|
ci: fmt vet test verify ## Everything the pipeline runs
|
|
|
|
dev-redis:
|
|
@redis-cli -p $(DEV_REDIS_PORT) ping >/dev/null 2>&1 || { \
|
|
echo "starting redis on :$(DEV_REDIS_PORT)"; \
|
|
redis-server --port $(DEV_REDIS_PORT) --daemonize yes --save '' --appendonly no; \
|
|
for i in $$(seq 1 30); do redis-cli -p $(DEV_REDIS_PORT) ping >/dev/null 2>&1 && break; sleep 0.2; done; }
|
|
@redis-cli -p $(DEV_REDIS_PORT) ping | sed 's/^/redis: /'
|
|
|
|
dev: dev-redis build ## Run hushd locally against a local Redis
|
|
@echo "hushd on $(BASE) — open it in a browser"
|
|
@APP_ENV=dev REDIS_URL=$(DEV_REDIS_URL) HUSH_PORT=$(HUSH_PORT) .build/hushd
|
|
|
|
dev-stop: ## Stop the local Redis
|
|
@redis-cli -p $(DEV_REDIS_PORT) shutdown nosave 2>/dev/null || true
|
|
@echo "stopped"
|
|
|
|
smoke: ## Full create -> reveal -> gone against a locally running hushd
|
|
@BASE=$(BASE) ./scripts/smoke.sh
|
|
|
|
mcp: ## Build and install the MCP server, then register it with omp
|
|
@$(MAKE) --no-print-directory mcp-install
|
|
|
|
mcp-install:
|
|
@./scripts/install-mcp.sh
|
|
|
|
deploy-manifests: ## Apply the k8s manifests (do this BEFORE the first push)
|
|
@KUBECONFIG=$(KUBECONFIG_FILE) kubectl apply -f deployments/k8s/hush.yaml
|
|
|
|
deploy-status: ## Rollout, pods, ingress and certificate
|
|
@KUBECONFIG=$(KUBECONFIG_FILE) kubectl -n $(NS) rollout status deployment/hush --timeout=90s
|
|
@KUBECONFIG=$(KUBECONFIG_FILE) kubectl -n $(NS) get pod,svc,ingress -l app=hush
|
|
@KUBECONFIG=$(KUBECONFIG_FILE) kubectl -n $(NS) get certificate hush-tls 2>/dev/null || true
|
|
|
|
logs: ## Tail hush's structured logs out of VictoriaLogs
|
|
@./scripts/logs.sh
|
|
|
|
alerts-check: ## Confirm vmalert has loaded hush's rules
|
|
@./scripts/alerts-check.sh
|