mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor(server): Load GCS signing key from service account key

Browse source 
The JSON file generated for service account keys already contains the
required information for signing URLs in GCS, thus the environment
variables for toggling signing behaviour have been removed.

Signing is now enabled automatically in the presence of service
account credentials (i.e. `GOOGLE_APPLICATION_CREDENTIALS`).
This commit is contained in:
Vincent Ambo 2019-10-27 13:36:53 +01:00 committed by Vincent Ambo
parent cca835ae37
commit 3a5db4f9f1
1 changed files with 17 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
tools/nixery/server/config/config.go
View file

@ -23,29 +23,33 @@ import (
"cloud.google.com/go/storage"
log "github.com/sirupsen/logrus"
"golang.org/x/oauth2/google"
)
// Load (optional) GCS bucket signing data from the GCS_SIGNING_KEY and
// GCS_SIGNING_ACCOUNT envvars.
// Configure GCS URL signing in the presence of a service account key
// (toggled if the user has set GOOGLE_APPLICATION_CREDENTIALS).
func signingOptsFromEnv() *storage.SignedURLOptions {
path := os.Getenv("GCS_SIGNING_KEY")
id := os.Getenv("GCS_SIGNING_ACCOUNT")
if path == "" || id == "" {
log.Info("GCS URL signing disabled")
path := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")
if path == "" {
return nil
}
log.WithField("account", id).Info("GCS URL signing enabled")
k, err := ioutil.ReadFile(path)
key, err := ioutil.ReadFile(path)
if err != nil {
log.WithError(err).WithField("file", path).Fatal("failed to read GCS signing key")
log.WithError(err).WithField("file", path).Fatal("failed to read service account key")
}
conf, err := google.JWTConfigFromJSON(key)
if err != nil {
log.WithError(err).WithField("file", path).Fatal("failed to parse service account key")
}
log.WithField("account", conf.Email).Info("GCS URL signing enabled")
return &storage.SignedURLOptions{
GoogleAccessID: id,
PrivateKey: k,
Scheme: storage.SigningSchemeV4,
GoogleAccessID: conf.Email,
PrivateKey: conf.PrivateKey,
Method: "GET",
}
}