npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2024 – Pkg Stats / Ryan Hefner

mycro-secrets

v0.6.0-1

Published

mycro hook for loading secrets from the environment or a vault server

Downloads

3

Readme

mycro-secrets

a vault hook for mycro apps.

Install

Install the hook

npm install --save mycro-secrets

Add it to hook config before any other hooks

// in config/hooks.js
module.exports = [
    'mycro-secrets',
    // ..
]

Background

Most applications require secrets (sensitive data like credentials, api keys, tokens, etc) to interact with other services, databases, and third party apis. Most applications resort to environment variables for storing this sensitive data, but environment variables can become hard to manage and update. Vault has proven to be a very elegant tool for managing these secrets. This hook aims to abstract away the logic involved in fetching and renewing secrets and provide a simple and declarative api for specifying the secrets that an app requires before starting.

Getting Started

  1. define your hook config

    // in config/secrets.js
    const joi = require('joi');
    
    module.exports = {
        // define a function for retrieving our 'secrets' config
        config(mycro, cb) {
            // fetch your secrets config here
            cb(null, config);
        },
    
        // define a validation function to ensure that the secrets we receive
        // from vault include everything we require
        validate(secrets, cb) {
            joi.validate(secrets, joi.object({
                bugsnag: joi.object({
                    apiKey: joi.string().required()
                }),
                mongo: joi.object({
                    host: joi.string().uri().required(),
                    username: joi.string().required(),
                    password: joi.string().required()
                }).required()
            }).required(), cb);
        }
    }
  2. define a secrets configuration somewhere (dynamo, s3, etc), and pass it to the hook

    {
        "envs": {
            "production": {
                "auth": {
                    "backend": "userpass",
                    "options": {
                        "username": "my-app",
                        "password": "my-password"
                    },
                    "retry": {
                        "forever": true,
                        "factor": 2,
                        "minTimeout": 100,
                        "maxTimeout": 900000
                    }
                },
                "secrets": {
                    "/secrets/my-app/production": {
                        "/bugsnag": "bugsnag",
                        "/mongo": "mongo"
                    }
                }
            },
            "development": {
                "auth": {
                    "backend": "userpass",
                    "options": {
                        "username": "my-app_dev",
                        "password": "my-password_dev"
                    },
                    "retry": {
                        "forever": true,
                        "factor": 2,
                        "minTimeout": 100,
                        "maxTimeout": 900000
                    }
                },
                "secrets": {
                    "/secrets/my-app/dev": {
                        "/bugsnag": "bugsnag",
                        "/mongo": "mongo"
                    }
                },
            }
        },
        "vault": {
            "url": "http://vault:8200/v1"
        }
    }
  3. include this hook in your hooks config

    // in config/hooks.js
    module.exports = [
        // ..
        'mycro-secrets',
        // ..
    ];
  4. use your secrets

    console.log(mycro.secrets('mongo'))
    // {
    //     "host": "localhost",
    //     "username": "<username>",
    //     "password": "<password"
    // }

API

DynamoDB

Secret configurations are stored in DynamoDB. The table definition must have a hash key with name id and type string. The config items follow the schema outlined below:

{
    // the id of the config object
    "id": "<config-id>",

    // a map of secret urls to request from vault
    // note: a multi level map will be flattened and
    // concatenated with the vault url specified below
    "secrets": {
        "/cubbhole": {
            "/common": "common",
            "/my-service": {
                "/bugsnag": "bugsnag"
            }
        }
    },

    "vault": {
        // OPTIONAL vault token to use in production
        // note: if a VAULT_TOKEN environment variable is found, it will be used instead
        "token": "<x-vault-token>",

        // OPTIONAL vault token to use during tests
        // note: if a VAULT_TOKEN_TEST environment variable is found, it will be used instead
        "test-token": "<x-vault-token>",

        // the vault server endpoint
        "url": "https://www.example.com/api/vault/v1"
    }
}

Using the config above, this hook will make the following requests from vault:

  • GET https://www.example.com/api/vault/v1/cubbyhole/common
    • the returned secret will be available at mycro.secrets('common')
  • GET https://www.example.com/api/vault/v1/cubbyhole/my-service/bugsnag
    • the returned secret will be available at mycro.secrets('bugsnag')

Hook Config

This hook can be configured by defining a configuration file at config/secrets.js. The structure of this file is outlined below:

// in config/secrets.js
module.exports = {
    // the number of times to attempt to retreive each secret from vault.
    // if falsey, it will retry indefinitely (default)
    attempts: 3,

    // the id of the config object to request from DynamoDB
    configId: 'my-service',

    // how long to wait in between attempts
    interval: '30s', // can also be an integer representing milliseconds to wait

    // the dynamodb region to request from
    region: 'us-west-2',

    // the name of the dynamodb table holding config items`
    tableName: 'my-config-table',

    // a validation function that should return a joi schema that will be
    // used to validate the fetched secrets
    validate: function(joi) {
        return joi.object({
            // ...
        }).required()
    }
}

Testing

Run the test suite:

npm test

Run coverage:

grunt coverage

Contributing

  1. Fork it
  2. Create your feature branch (git checkout -b my-new-feature)
  3. Commit your changes (git commit -am 'Add some feature')
  4. Push to the branch (git push origin my-new-feature)
  5. Create new Pull Request

License

Copyright (c) 2016 Chris Ludden. Licensed under the MIT license.