This is the multi-page printable view of this section. Click here to print.
The root //:vault and //:vault.* labels delegate to wrappers in
//tools/vault/cmd/workspace, using //tools/al:config. //tools/vault:vault
is the standalone CLI; the wrappers add the existing AL environment injection.
The pinned upstream binary is owned by
third_party/com_hashicorp_vault.
Plugin data supplies the default Forgejo URL, OIDC source, Vault connection,
and Vault authentication. One selected plugin_call may override nonempty
configuration fields, for example vault_auth = "forgejo_registration",
while inheriting the remaining defaults. Calls without overrides preserve
the defaults. Multiple calls with overrides and malformed configuration are
rejected before authentication; configuration values are omitted from errors.
The plugin registers token removal before issuance, using a unique token name. Startup failure and normal shutdown attempt removal through the authenticated Forgejo browser session, including when creation did not return a usable token. Cleanup parses the complete applications settings page and verifies token absence after deletion. It then logs out the invocation’s browser session and verifies that the retained original cookie no longer accesses authenticated settings. Cleanup failures are reported.
The parser follows the Forgejo 15.0.3 applications template: all tokens appear on
one page, each in a flex-item row with a title and a matching delete button.
It requires the applications page marker and new-token link before accepting an
empty list. Login pages, invalid token IDs, duplicates, and responses larger than
4 MiB fail closed. A changed upstream template may require a parser update.
Network requests have a ten-second timeout and honor cancellation. Forced process
termination or an unavailable Forgejo server can prevent cleanup; Forgejo tokens
do not acquire an expiry merely because this plugin created them.
load("@rules_java//java:defs.bzl", "java_library")
java_library(
name = "name",
deps = [
"@com_alwaldend_src//tools/vault/forgejo_login:api_java_library",
],
)
load("@rules_go//go:def.bzl", "go_library")
go_library(
name = "name",
deps = [
"@com_alwaldend_src//tools/vault/forgejo_login:forgejo_login",
],
)
syntax = "proto3";
package com.alwaldend.src.tools.vault.forgejo_login.forgejo_login_proto;
option go_package = "git.alwaldend.com/alwaldend/src/tools/vault/forgejo_login/forgejo_login_proto";
message Config {
string forgejo_url = 1;
string forgejo_oauth_name = 2;
string vault_conn = 3;
string vault_auth = 4;
}
The plugin destroys its Harbor session on normal shutdown and checks that the
original session ID is rejected by the current-user API. Cleanup uses Harbor’s
/c/oidc/logout endpoint (available in newer Harbor releases) and does not follow
the optional identity-provider logout redirect. Unsupported endpoints, network
failures, or sessions that remain valid are reported as cleanup errors. Session
expiry remains server-controlled; forced termination cannot guarantee logout.
The session destruction behavior is defined by Harbor’s OIDC controller. Vault tokens created by the invocation are revoked after session cleanup.
load("@rules_java//java:defs.bzl", "java_library")
java_library(
name = "name",
deps = [
"@com_alwaldend_src//tools/vault/harbor_login:api_java_library",
],
)
load("@rules_go//go:def.bzl", "go_library")
go_library(
name = "name",
deps = [
"@com_alwaldend_src//tools/vault/harbor_login:harbor_login",
],
)
syntax = "proto3";
package com.alwaldend.src.tools.vault.harbor_login.harbor_login_proto;
option go_package = "git.alwaldend.com/alwaldend/src/tools/vault/harbor_login/harbor_login_proto";
message Config {
string harbor_url = 1;
string vault_conn = 2;
string vault_auth = 3;
}
Shutdown first drains plugin requests, then stops and waits for resource
processes, revokes invocation-owned Vault credentials, and deletes temporary
files and SSH key directories. Failed cleanup is reported. Registration after
shutdown is rejected; a fetcher removes any unregistered temporary material.
Temporary files use mode 0600 and directories use 0700. Deletion is filesystem
unlinking, not secure erasure, and cannot run after SIGKILL or host failure.
no_auth explicitly sets the injected VAULT_TOKEN to an empty value so an
inherited token is overridden. This does not remove the user’s token-helper
file; commands that independently consult that helper may still authenticate.
Template errors and OIDC status errors omit input and response contents.
OIDC requests honor cancellation and do not follow redirects.
load("@rules_java//java:defs.bzl", "java_library")
java_library(
name = "name",
deps = [
"@com_alwaldend_src//tools/vault/injector:api_java_library",
],
)
load("@rules_go//go:def.bzl", "go_library")
go_library(
name = "name",
deps = [
"@com_alwaldend_src//tools/vault/injector:injector",
],
)
syntax = "proto3";
package com.alwaldend.src.tools.vault.injector.injector_proto;
option go_package = "git.alwaldend.com/alwaldend/src/tools/vault/injector/injector_proto";
message File {
string value = 1;
string from_file = 2;
map<string, string> extra = 3;
}
message Env {
string value = 1;
}
message Kv {
// Secret path
string path = 1;
// Secret mount
string mount = 2;
}
message Op {
string method = 1;
string path = 4;
map<string, string> data = 5;
}
message VaultSsh {
string backend = 1;
int64 ttl = 2;
}
message Process {
string name = 1;
repeated string args = 2;
}
message Oidc {
string name = 1;
string scope = 2;
string client_id = 3;
string redirect_uri = 4;
}
message VaultEnv {
// Vault connection
string conn = 1;
// Vault auth
string auth = 2;
}
message Resource {
// Resource name
string name = 1;
// Vault connection for the resource
string vault_conn = 2;
// Vault auth for the resource
string vault_auth = 3;
// Dependencies
repeated string deps = 8;
oneof res {
// Vault operation
Op op = 4;
// Vault KV secret
Kv kv = 5;
// Environment variable
Env env = 6;
// File
File file = 7;
// Vault environment variables
VaultEnv vault_env = 9;
// Ssh key signed by Vautl
VaultSsh vault_ssh = 10;
// Run a cmd
Process process = 11;
// Create an OIDC token
Oidc oidc = 12;
}
}
message Config {
// Resources
repeated Resource res = 1;
}
The plugin requests an API token with a one-hour expiry and deletes that token on shutdown using the retained login ticket and CSRF token. The token name is registered for cleanup before creation, so cleanup is attempted even when a creation response is lost or malformed. Failures to delete are reported; expiry is the fallback when shutdown cannot complete. Pre-existing credentials are not revoked. Vault tokens created by the invocation are revoked after token cleanup.
Token deletion uses the Proxmox user token API.
load("@rules_java//java:defs.bzl", "java_library")
java_library(
name = "name",
deps = [
"@com_alwaldend_src//tools/vault/pve_login:api_java_library",
],
)
load("@rules_go//go:def.bzl", "go_library")
go_library(
name = "name",
deps = [
"@com_alwaldend_src//tools/vault/pve_login:pve_login",
],
)
syntax = "proto3";
package com.alwaldend.src.tools.vault.pve_login.pve_login_proto;
option go_package = "git.alwaldend.com/alwaldend/src/tools/vault/pve_login/pve_login_proto";
message Config {
string pve_base_url = 1;
string pve_redirect_url = 2;
string pve_realm = 3;
string vault_conn = 4;
string vault_auth = 5;
}
The plugin tracks each running backend for shutdown, including backends created before a later call fails. Shutdown drains HTTP requests before revoking the backend’s invocation-owned Vault credentials. If the shutdown deadline expires, connections are forcibly closed and the timeout is reported. Normal HTTP server closure is not an error. Vault requests use their incoming request context.
load("@rules_java//java:defs.bzl", "java_library")
java_library(
name = "name",
deps = [
"@com_alwaldend_src//tools/vault/tf_backend:api_java_library",
],
)
load("@rules_go//go:def.bzl", "go_library")
go_library(
name = "name",
deps = [
"@com_alwaldend_src//tools/vault/tf_backend:tf_backend",
],
)
syntax = "proto3";
package com.alwaldend.src.tools.vault.tf_backend.tf_backend_proto;
option go_package = "git.alwaldend.com/alwaldend/src/tools/vault/tf_backend/tf_backend_proto";
message Config {
string vault_conn = 1;
string vault_auth = 2;
string vault_secret = 3;
string vault_secret_mount = 4;
}