-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Lorenzo Toscano
committed
Sep 9, 2024
1 parent
55af101
commit dc38ec7
Showing
12 changed files
with
464 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,43 @@ | ||
# Python | ||
__pycache__/ | ||
*.py[cod] | ||
*$py.class | ||
*.so | ||
.Python | ||
build/ | ||
develop-eggs/ | ||
dist/ | ||
downloads/ | ||
eggs/ | ||
.eggs/ | ||
lib/ | ||
lib64/ | ||
parts/ | ||
sdist/ | ||
var/ | ||
wheels/ | ||
*.egg-info/ | ||
.installed.cfg | ||
*.egg | ||
|
||
# Virtual environment | ||
venv/ | ||
ENV/ | ||
|
||
# IDEs and editors | ||
.idea/ | ||
.vscode/ | ||
*.swp | ||
*.swo | ||
|
||
# OS generated files | ||
.DS_Store | ||
.DS_Store? | ||
._* | ||
.Spotlight-V100 | ||
.Trashes | ||
ehthumbs.db | ||
Thumbs.db | ||
|
||
# KeyVault specific | ||
.secrets/ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,53 @@ | ||
# Contributing to KeyVault | ||
|
||
We love your input! We want to make contributing to this project as easy and transparent as possible, whether it's: | ||
|
||
- Reporting a bug | ||
- Discussing the current state of the code | ||
- Submitting a fix | ||
- Proposing new features | ||
- Becoming a maintainer | ||
|
||
## We Develop with Github | ||
|
||
We use github to host code, to track issues and feature requests, as well as accept pull requests. | ||
|
||
## We Use [Github Flow](https://guides.github.com/introduction/flow/index.html) | ||
|
||
Pull requests are the best way to propose changes to the codebase. We actively welcome your pull requests: | ||
|
||
1. Fork the repo and create your branch from `main`. | ||
2. If you've added code that should be tested, add tests. | ||
3. If you've changed APIs, update the documentation. | ||
4. Ensure the test suite passes. | ||
5. Make sure your code lints. | ||
6. Issue that pull request! | ||
|
||
## Any contributions you make will be under the MIT Software License | ||
|
||
In short, when you submit code changes, your submissions are understood to be under the same [MIT License](http://choosealicense.com/licenses/mit/) that covers the project. | ||
|
||
## Report bugs using Github's [issues](https://github.com/ltoscano/keyvault/issues) | ||
|
||
We use GitHub issues to track public bugs. Report a bug by opening a new issue; it's that easy! | ||
|
||
## Write bug reports with detail, background, and sample code | ||
|
||
**Great Bug Reports** tend to have: | ||
|
||
- A quick summary and/or background | ||
- Steps to reproduce | ||
- Be specific! | ||
- Give sample code if you can. | ||
- What you expected would happen | ||
- What actually happens | ||
- Notes (possibly including why you think this might be happening, or stuff you tried that didn't work) | ||
|
||
## Use a Consistent Coding Style | ||
|
||
* 4 spaces for indentation rather than tabs | ||
* You can try running `pylint` for style unification | ||
|
||
## License | ||
|
||
By contributing, you agree that your contributions will be licensed under its MIT License. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,36 @@ | ||
# Use an official Python runtime as a parent image | ||
FROM python:3.9-slim-buster | ||
|
||
# Set environment variables | ||
ENV PYTHONDONTWRITEBYTECODE 1 | ||
ENV PYTHONUNBUFFERED 1 | ||
ENV KEYVAULT_PORT 38680 | ||
|
||
# Set work directory | ||
WORKDIR /app | ||
|
||
# Install system dependencies | ||
RUN apt-get update && apt-get install -y --no-install-recommends \ | ||
gcc \ | ||
curl \ | ||
&& rm -rf /var/lib/apt/lists/* | ||
|
||
# Install Python dependencies | ||
COPY requirements.txt . | ||
RUN pip install --no-cache-dir -r requirements.txt | ||
|
||
# Copy project | ||
COPY . . | ||
|
||
# Create .secrets directory | ||
RUN mkdir -p .secrets && chown -R root:root .secrets && chmod 755 .secrets | ||
|
||
# Create a non-root user and switch to it | ||
RUN adduser --disabled-password --gecos '' appuser | ||
USER appuser | ||
|
||
# Run the application | ||
CMD ["python", "keyvault/server.py"] | ||
|
||
# Expose the port | ||
EXPOSE $KEYVAULT_PORT |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,185 @@ | ||
# KeyVault | ||
|
||
## Introduction | ||
|
||
Simple, fast, convenient! KeyVault is a simple yet effective solution born out of the growing need to centralize the management of cloud service keys, particularly in development environments. With the proliferation of cloud services, especially those related to Large Language Models (LLMs) and other AI technologies, developers often find themselves juggling multiple API keys and secrets across various projects. | ||
|
||
This application addresses the challenge by providing a centralized point for storing and retrieving these keys, streamlining the development process and enhancing security practices. While primarily designed for personal development environments, KeyVault can also serve as a lightweight solution for small teams or projects. | ||
|
||
Key features and benefits include: | ||
|
||
- Centralized storage of API keys and secrets | ||
- Easy integration with development workflows | ||
- Simplified key management across multiple projects | ||
- Improved security through centralized access control | ||
|
||
It's important to note that while KeyVault is a practical solution for development environments, it is not intended as a robust, production-grade secret management system. In production contexts, this solution can be easily replaced by more comprehensive, battle-tested alternatives provided by cloud service providers or specialized secret management tools. | ||
|
||
The simplicity and flexibility of KeyVault make it an ideal stepping stone, allowing developers to establish good key management practices in their development workflow, which can then be seamlessly transitioned to more robust solutions in production environments. | ||
|
||
## Features | ||
|
||
- Secure storage of key-value pairs | ||
- RESTful API for key retrieval and listing | ||
- Python client for easy integration | ||
- Dockerized server for easy deployment | ||
- Logging and improved error handling | ||
- Support for both Docker and Docker Compose deployment | ||
- Easy key management with local volume mapping | ||
|
||
## Prerequisites | ||
|
||
- Python 3.7+ | ||
- Docker and Docker Compose (for containerized deployment) | ||
|
||
## Quickstart | ||
|
||
1. Clone the repository and navigate to the project directory: | ||
``` | ||
git clone https://github.com/yourusername/keyvault.git | ||
cd keyvault | ||
``` | ||
|
||
2. Create a `.secrets` directory and add your configuration: | ||
``` | ||
mkdir .secrets | ||
echo '{"OPENAI_API_KEY": "your-api-key-here", "OTHER_KEY": "another-key-value"}' > .secrets/config.json | ||
``` | ||
|
||
3. Start the server using Docker Compose: | ||
``` | ||
KEYVAULT_PORT=38680 docker-compose up -d | ||
``` | ||
You can change the port by modifying the KEYVAULT_PORT environment variable. | ||
|
||
4. Verify that the server is running: | ||
``` | ||
curl http://localhost:38680/list_keys | ||
``` | ||
|
||
5. Use the client to interact with the server. Create a file named `test_client.py`: | ||
|
||
```python | ||
from keyvault.client import KeyVaultClient | ||
import logging | ||
import os | ||
|
||
logging.basicConfig(level=logging.INFO) | ||
|
||
# Use environment variables or default values | ||
host = os.environ.get('KEYVAULT_HOST', 'localhost') | ||
port = os.environ.get('KEYVAULT_PORT', '38680') | ||
|
||
client = KeyVaultClient(f"http://{host}:{port}") | ||
|
||
try: | ||
# Get a specific key | ||
api_key = client.get_key('OPENAI_API_KEY') | ||
print("API Key:", api_key) | ||
|
||
# List all keys | ||
keys = client.list_keys() | ||
print("Available keys:", keys) | ||
except Exception as e: | ||
print(f"An error occurred: {str(e)}") | ||
``` | ||
|
||
6. Run the client: | ||
``` | ||
python test_client.py | ||
``` | ||
|
||
### Using Docker | ||
|
||
1. Build the Docker image: | ||
``` | ||
docker build -t keyvault-server . | ||
``` | ||
|
||
2. Run the Docker container, mapping your local `.secrets` directory: | ||
``` | ||
docker run -d -p 38680:38680 -v $(pwd)/.secrets:/app/.secrets:ro --name keyvault-server keyvault-server | ||
``` | ||
|
||
The server will be available at `http://localhost:38680`. | ||
|
||
## Configuration | ||
|
||
Store your keys in the `keyvault/.secrets/config.json` file: | ||
|
||
```json | ||
{ | ||
"OPENAI_API_KEY": "your-api-key-here", | ||
"OTHER_KEY": "another-key-value" | ||
} | ||
``` | ||
|
||
KeyVault can be configured using the following environment variables: | ||
|
||
KEYVAULT_HOST: The host address on which the KeyVault server will listen. Default is 0.0.0.0. | ||
KEYVAULT_PORT: The port on which the KeyVault server will listen. Default is 38680. | ||
|
||
You can update this file at any time, and the changes will be immediately reflected in the running container without the need to rebuild or restart. | ||
|
||
## Intended Usage and Security Considerations | ||
|
||
KeyVault is designed to be used as a component within a development environment, typically composed of multiple containers communicating over a private Docker network. In this setup, each new development project has its own set of containers and communicates with the KeyVault container to retrieve the appropriate keys when needed. | ||
|
||
### Best Practices: | ||
|
||
1. **Private Network**: It is strongly recommended to run KeyVault on a private Docker network, accessible only to your development containers. | ||
|
||
2. **Not for Public Access**: KeyVault should never be exposed to the public internet. It is designed for local development environments only. | ||
|
||
3. **Responsible Configuration**: When using KeyVault in a multi-container setup on a private network, it's not necessary to expose the port on the host (i.e., you don't need to use 0.0.0.0). The KeyVault container can be accessed only by other containers on the same private network, enhancing security. | ||
|
||
4. **Separate Instances**: For different projects or development environments, consider running separate instances of KeyVault to maintain isolation. | ||
|
||
5. **Regular Updates**: Keep your KeyVault instance and its dependencies up to date to ensure you have the latest security patches. | ||
|
||
### Example Setup: | ||
|
||
Here's a basic example of how you might set up KeyVault in a Docker network without exposing ports to the host: | ||
|
||
```yaml | ||
version: '3.8' | ||
|
||
networks: | ||
dev-network: | ||
driver: bridge | ||
|
||
services: | ||
keyvault: | ||
build: . | ||
networks: | ||
- dev-network | ||
environment: | ||
- KEYVAULT_PORT=38680 | ||
volumes: | ||
- ./.secrets:/app/.secrets:ro | ||
|
||
your-app: | ||
build: ./your-app | ||
networks: | ||
- dev-network | ||
environment: | ||
- KEYVAULT_HOST=keyvault | ||
- KEYVAULT_PORT=38680 | ||
depends_on: | ||
- keyvault | ||
``` | ||
In this setup: | ||
- KeyVault is not exposing any ports to the host system. | ||
- `your-app` can access KeyVault at `http://keyvault:38680` within the `dev-network`. | ||
- KeyVault is not accessible from outside the `dev-network`, providing an additional layer of security. | ||
|
||
Remember, the security of your development environment and the keys stored in KeyVault is your responsibility. Always follow best practices for securing sensitive information. | ||
|
||
## Contributing | ||
|
||
Please read [CONTRIBUTING.md](CONTRIBUTING.md) for details on our code of conduct and the process for submitting pull requests. | ||
|
||
## License | ||
|
||
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,17 @@ | ||
version: '3.8' | ||
|
||
services: | ||
keyvault: | ||
build: . | ||
ports: | ||
- "${KEYVAULT_PORT:-38680}:38680" | ||
volumes: | ||
- ${SECRETS_PATH:-./.secrets}:/app/.secrets:ro | ||
environment: | ||
- KEYVAULT_PORT=38680 | ||
restart: unless-stopped | ||
healthcheck: | ||
test: ["CMD", "curl", "-f", "http://localhost:38680/list_keys"] | ||
interval: 30s | ||
timeout: 10s | ||
retries: 3 |
Empty file.
Oops, something went wrong.