6a59d34bb1
Update configuration files, templates, and internal documentation for the provisioning repository system. Configuration Updates: - KMS configuration modernization - Plugin system settings - Service port mappings - Test cluster topologies - Installation configuration examples - VM configuration defaults - Cedar authorization policies Documentation Updates: - Library module documentation - Extension API guides - AI system documentation - Service management guides - Test environment setup - Plugin usage guides - Validator configuration documentation All changes are backward compatible.
125 lines
3.5 KiB
TOML
125 lines
3.5 KiB
TOML
# KMS Service Configuration
|
|
# Simplified to support only Age (development) and Cosmian KMS (production)
|
|
|
|
[kms]
|
|
# Backend selection based on environment
|
|
# Options: "age" (development, local) or "cosmian" (production, enterprise)
|
|
dev_backend = "age"
|
|
prod_backend = "cosmian"
|
|
|
|
# Current environment (dev or prod)
|
|
# Can be overridden with PROVISIONING_ENV environment variable
|
|
environment = "${PROVISIONING_ENV:-dev}"
|
|
|
|
# Service configuration
|
|
host = "0.0.0.0"
|
|
port = 8082
|
|
log_level = "info"
|
|
|
|
[kms.age]
|
|
# Age encryption for development
|
|
# Fast, offline, no server required
|
|
# Generate keys with: age-keygen -o private_key.txt
|
|
|
|
# Public key path (for encryption)
|
|
public_key_path = "~/.config/provisioning/age/public_key.txt"
|
|
|
|
# Private key path (for decryption)
|
|
private_key_path = "~/.config/provisioning/age/private_key.txt"
|
|
|
|
# Usage notes:
|
|
# - Best for local development and testing
|
|
# - No network dependency
|
|
# - Keys are stored locally
|
|
# - Manual key rotation (generate new keys and update config)
|
|
|
|
[kms.cosmian]
|
|
# Cosmian KMS for production
|
|
# Enterprise-grade, confidential computing support, zero-knowledge architecture
|
|
|
|
# Cosmian KMS server URL
|
|
# Can be overridden with COSMIAN_KMS_URL environment variable
|
|
server_url = "${COSMIAN_KMS_URL:-https://kms.example.com}"
|
|
|
|
# API key for authentication
|
|
# MUST be set via COSMIAN_API_KEY environment variable (never hardcode)
|
|
api_key = "${COSMIAN_API_KEY}"
|
|
|
|
# Default master key ID for encryption operations
|
|
# This key should be created in Cosmian KMS before use
|
|
default_key_id = "provisioning-master-key"
|
|
|
|
# TLS certificate verification
|
|
# Set to false only for development/testing with self-signed certs
|
|
tls_verify = true
|
|
|
|
# Confidential computing options (requires SGX/SEV hardware)
|
|
use_confidential_computing = false
|
|
|
|
# Key rotation policy
|
|
# Cosmian KMS handles rotation server-side based on these settings
|
|
[kms.cosmian.rotation]
|
|
# Automatic key rotation interval (in days)
|
|
# 0 = disabled (manual rotation only)
|
|
key_rotation_days = 90
|
|
|
|
# Retain old key versions for decryption
|
|
retain_old_versions = true
|
|
|
|
# Maximum number of key versions to retain
|
|
max_versions = 5
|
|
|
|
# Usage notes:
|
|
# - Requires Cosmian KMS server (cloud or self-hosted)
|
|
# - Best for production environments
|
|
# - Supports confidential computing (TEE/SGX/SEV)
|
|
# - Server-side key rotation
|
|
# - Audit logging and compliance features
|
|
|
|
# Example backend configurations for different environments
|
|
[kms.profiles]
|
|
|
|
[kms.profiles.development]
|
|
backend = "age"
|
|
public_key_path = "~/.config/provisioning/age/public_key.txt"
|
|
private_key_path = "~/.config/provisioning/age/private_key.txt"
|
|
|
|
[kms.profiles.staging]
|
|
backend = "cosmian"
|
|
server_url = "https://kms-staging.example.com"
|
|
default_key_id = "provisioning-staging-key"
|
|
tls_verify = true
|
|
|
|
[kms.profiles.production]
|
|
backend = "cosmian"
|
|
server_url = "https://kms.example.com"
|
|
default_key_id = "provisioning-master-key"
|
|
tls_verify = true
|
|
use_confidential_computing = true
|
|
|
|
# Quick Start Guide
|
|
#
|
|
# Development (Age):
|
|
# 1. Generate Age keys:
|
|
# age-keygen -o ~/.config/provisioning/age/private_key.txt
|
|
# age-keygen -y ~/.config/provisioning/age/private_key.txt > ~/.config/provisioning/age/public_key.txt
|
|
#
|
|
# 2. Set environment:
|
|
# export PROVISIONING_ENV=dev
|
|
#
|
|
# 3. Start KMS service:
|
|
# cargo run --bin kms-service
|
|
#
|
|
# Production (Cosmian):
|
|
# 1. Set up Cosmian KMS server (or use hosted service)
|
|
#
|
|
# 2. Create master key in Cosmian KMS
|
|
#
|
|
# 3. Set environment variables:
|
|
# export PROVISIONING_ENV=prod
|
|
# export COSMIAN_KMS_URL=https://your-kms.example.com
|
|
# export COSMIAN_API_KEY=your-api-key-here
|
|
#
|
|
# 4. Start KMS service:
|
|
# cargo run --bin kms-service
|