Documentation
¶
Overview ¶
Package services owns the three built-in identity and secrets services -- Keycloak, OpenBao and dex -- beyond what the compose file can express.
Two of them need a configuration file carrying the domain and generated secrets, which an embedded asset cannot provide, so those are RENDERED into DRAGONRUN_HOME on every `up` exactly as caddy site files are. All three need a postgres role and database created before they will start. OpenBao needs one more thing on top: its storage is sealed, and the key that opens it is held in registry.json rather than by a human.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EnsureBao ¶
EnsureBao brings OpenBao from "container just started" to "unsealed and usable", and reports what it had to do.
The seal is the price of persistent storage, and paying it by hand on every `dragonrun up` would make the whole thing not worth having. So dragonrun holds the single unseal key in registry.json -- the same file that already holds every project's database password -- and opens the seal itself.
That is a real trade and worth stating plainly: anyone who can read registry.json can read every secret in OpenBao. It buys a local instance that behaves like the real thing (mounts, policies and JWT auth roles that survive a restart) instead of a dev-mode toy that forgets them.
func EnsureDatabases ¶
EnsureDatabases creates the role and database each service owns. Idempotent, and run on every `up` so an install that predates these services picks them up without a separate command.
func Issuer ¶
Issuer is the OIDC issuer of the imported Keycloak realm -- the value an application puts in its own configuration.
Types ¶
This section is empty.
Source Files