4d9a26498e
Paste a secret, get a link, send it. The first person to open it and press
Reveal sees the secret; the link dies at that moment. The recipient needs a
browser and nothing else — no account, no client, no installed tooling.
The server cannot read what it stores. AES-256-GCM happens in the browser and
the key lives in the URL fragment, which browsers never transmit, so hushd
holds ciphertext and no key material. That is a property of where the key sits
rather than a promise about our conduct, which is why there is deliberately no
endpoint accepting a plaintext secret and no server-side-encryption fallback:
two guarantees behind one URL would be worse than one honest guarantee.
Three decisions carry the design:
* GET /s/{id} touches NO storage, not even to check existence. Slack, Teams,
WhatsApp, iMessage and Outlook Safe Links all fetch a URL before a human
sees it, so destroying on GET would destroy most secrets in transit and the
recipient's "already used" would be indistinguishable from interception.
Only POST /reveal consumes. Bot user-agent detection is an arms race;
removing the side effect from GET is not. Pinned by
TestGettingTheRevealPageNeverConsumesTheSecret.
* Destruction is one Redis GETDEL, which is atomic. GET-then-DEL has a window
where two simultaneous readers both win, and for a one-time secret that
window is the product. The store contract demands atomicity and the same
concurrency test runs against both implementations.
* Missing, already-revealed, expired and evicted are ONE indistinguishable
410. Separating them would confirm to a prober that a given link was real.
The secret id IS the capability, so secret.ID is a struct whose every
accidental path — %v, %s, String(), slog, json.Marshal — emits a redacted
handle or refuses, and the raw value needs an explicit Value(). The first
version tried to prevent leaks by implementing no String() at all; its own test
caught that Go's fmt prints unexported fields anyway, so forbidding the method
had removed the control rather than the leak.
Operationally: structured JSON on stdout in the fleet's wire format, which
Vector already collects with no annotation; six hush_* metrics on the chassis
registry with no id, IP or path in any label; five alert rules wired into
vmalert. The public Ingress enumerates /, /s/ and /api/ so /metrics, /healthz
and /readyz share the port but are unreachable from the internet — no
basic-auth middleware to maintain and get wrong.
Dependencies are vendored because go-chassis is private: the Woodpecker test
step and the in-cluster Kaniko build both run -mod=vendor with GOPROXY=off and
hold no git credential.
cmd/hush-mcp is a stdio MCP server doing the same client-side crypto locally,
so using hush from an agent preserves the same guarantee as using it from a
browser.
66 lines
2.3 KiB
Go
66 lines
2.3 KiB
Go
package main
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/orchard9/go-chassis/config"
|
|
)
|
|
|
|
// Config is every knob hushd has. Loaded once at boot; a missing or malformed
|
|
// required value stops the process rather than being defaulted, so a
|
|
// misconfigured pod crashloops visibly instead of serving something subtly
|
|
// wrong.
|
|
type Config struct {
|
|
Env string
|
|
Port int
|
|
|
|
// RedisURL is REQUIRED. There is an in-memory store in the codebase for
|
|
// tests, and requiring this is what makes it impossible to select by
|
|
// accident in production: a pod with no REDIS_URL does not boot, rather
|
|
// than booting with a store that loses every secret on restart.
|
|
RedisURL string
|
|
|
|
// RateLimit bounds anonymous creates per client IP. Reveals are not
|
|
// limited by this: a recipient gets exactly one successful reveal by
|
|
// construction, so there is nothing to throttle, and throttling would let
|
|
// one noisy NAT block a colleague's delivery.
|
|
RateLimitCreates int
|
|
RateLimitWindow time.Duration
|
|
|
|
// TrustedProxyHops is how many Traefik hops sit in front of hushd, used to
|
|
// pick the real client IP out of X-Forwarded-For. Wrong-high lets a caller
|
|
// spoof their IP and evade the rate limit; wrong-low rate-limits the
|
|
// ingress itself and throttles everyone together.
|
|
TrustedProxyHops int
|
|
|
|
// AllowOrigins is the CORS allowlist. Empty is correct for the deployed
|
|
// service: both pages are same-origin, so no cross-origin caller is
|
|
// legitimate.
|
|
AllowOrigins []string
|
|
|
|
// RequireAuthToCreate closes anonymous create if the service is abused.
|
|
// Reveal stays anonymous regardless — the recipient is external and holds
|
|
// no credential.
|
|
RequireAuthToCreate bool
|
|
CreateToken string
|
|
}
|
|
|
|
func loadConfig() (Config, error) {
|
|
l := config.New()
|
|
cfg := Config{
|
|
Env: l.OneOf("APP_ENV", "dev", "dev", "staging", "prod"),
|
|
Port: l.Port("HUSH_PORT", 18500),
|
|
RedisURL: l.Required("REDIS_URL"),
|
|
RateLimitCreates: l.Int("HUSH_RATE_LIMIT_CREATES", 30),
|
|
RateLimitWindow: l.Duration("HUSH_RATE_LIMIT_WINDOW", 10*time.Minute),
|
|
TrustedProxyHops: l.Int("HUSH_TRUSTED_PROXY_HOPS", 1),
|
|
AllowOrigins: l.Strings("HUSH_ALLOW_ORIGINS", nil),
|
|
RequireAuthToCreate: l.Bool("HUSH_REQUIRE_AUTH", false),
|
|
CreateToken: l.String("HUSH_CREATE_TOKEN", ""),
|
|
}
|
|
if err := l.Err(); err != nil {
|
|
return Config{}, err
|
|
}
|
|
return cfg, nil
|
|
}
|