Documentation
¶
Overview ¶
Package boot wires the shared dependencies notifyd needs at startup.
In particular the KMS client: notifyd reads per-tenant provider credentials out of Hanzo KMS via internal/kmsbridge — a tiny, self- contained HTTP client that targets the canonical `/v1/kms/orgs/{org}/secrets/{path}/{name}` routes the deployed luxfi/kms server actually serves.
Why not borrow `github.com/hanzoai/base/plugins/platform.KMSClient`? That client at the version notify pins (`hanzoai/base v1.3.0`) still targets the legacy Infisical URLs (`/api/v1/secrets/{org}/{path}`). Bumping base to pick up the post-v1.3.0 platform/kms rewrite would carry every other unrelated change since then. The bridge avoids that by hitting KMS directly from notify.
Boot is intentionally tiny: one constructor + an env reader. The rest of the wiring lives in main.go.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IAMEndpoint ¶ added in v1.6.15
func IAMEndpoint() string
IAMEndpoint returns the configured IAM endpoint or empty. Required for the IAM client_credentials grant unless KMS_AUTH_TOKEN is set.
func KMSAuthToken ¶
func KMSAuthToken() string
KMSAuthToken returns the optional static bearer token for KMS. In production this stays empty and the bridge runs the IAM client_credentials exchange. Tests use a static token to short-circuit IAM.
func KMSEndpoint ¶
func KMSEndpoint() string
KMSEndpoint returns the configured KMS endpoint or empty. Empty means "KMS disabled" — the resolver then falls back to env-var credentials.
func NewKMSClient ¶
NewKMSClient builds a kmsbridge.Client from env. Returns nil when KMS_ENDPOINT is unset — callers must handle that case (nil is the well-defined "no KMS" mode, not an error).
Misconfiguration (e.g. KMS_ENDPOINT set but IAM_CLIENT_ID missing) is a fatal log; we want pods to crashloop loudly rather than silently run with broken KMS and fail every OTP send at request time.
Types ¶
This section is empty.
Source Files