HTTP ProxyBETA
The SecretHub HTTP Proxy adds a RESTful interface to the SecretHub Client. Apps can this way still use SecretHub, without having to directly include the client as a binary dependency.
You can configure it with a SecretHub credential at start, thereby removing the need of passing it in on every request.
SecretHub is a developer tool to help you keep database passwords, API tokens, and other secrets out of IT automation scripts.
The SecretHub HTTP Proxy opens up the configured SecretHub account over HTTP. This moves the responsibility of securing your secrets to the domain of network security, which comes with its own risks. So use this with caution and make sure the credential you pass in only has access to only those secrets it needs.
It is recommended to create a service account, tightly control it with access rules, and use the service credential instead of your own SecretHub account.
secrethub service init my-org/my-repo --permission read --desc my-app
Download and extract the latest release of the SecretHub HTTP Proxy. Start it with your SecretHub credential:
./secrethub-http-proxy -C $(cat ~/.secrethub/credential) -p 8080
If upon signup you've chosen to lock your credential with a passphrase, you will get prompted for your passphrase.
You can also run the proxy as a Docker container.
Assuming you have a SecretHub credential stored in the default $HOME/.secrethub location, you can run it with the credential mounted as a volume:
docker run -p 127.0.0.1:8080:8080 --name secrethub -v $HOME/.secrethub:/secrethub secrethub/http-proxy
You can also pass in the credential as an environment variable:
docker run -p 127.0.0.1:8080:8080 --name secrethub -e SECRETHUB_CREDENTIAL=$(cat $HOME/.secrethub/credential) secrethub/http-proxy
If upon signup you've chosen to lock your credential with a passphrase, run the container with -it to get prompted for your passphrase.
docker run -it -p 127.0.0.1:8080:8080 --name secrethub -e SECRETHUB_CREDENTIAL=$(cat $HOME/.secrethub/credential) secrethub/http-proxy
Alternatively, the passphrase can be sourced from the SECRETHUB_CREDENTIAL_PASSPHRASE environment variable.
With the proxy up and running, you can perform the following HTTP requests:
Example:
/v1beta/secrets/raw/my-org/my-repo/my-secret
Returns the secret contents as bytes.
Creates or updates a secret. Expects the secret contents as bytes.
Deletes the entire secret and its history.
This project is currently in beta and we'd love your feedback! Check out the issues and feel free to suggest cool ideas, use cases, or improvements.
Because it's still in beta, you can expect to see some changes introduced. Pull requests are very welcome.
For those of you using Terraform, the SecretHub HTTP Proxy can function as a Terraform Backend for your .tfstate.
Read more about this on our blog post.
Get the source code:
git clone https://github.com/secrethub/secrethub-http-proxy
To build the binary from source, use:
make build
To build the Docker image from scratch, you can use:
docker build -t secrethub-http-proxy .