theta42/jump-host
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v1.14.0: load secrets from OpenBao at boot via @simpleworkjs/bao-conf

Browse Source 
bin/www now runs bao-conf.init({ path: 'jump-host' }) before
require('../models'), so the OIDC clientSecret captured at require time
inside createOidcClient sees the OpenBao-merged config. Authenticates to
OpenBao with a scoped VAULT_TOKEN (policy jump-host), never the root
token; fail-soft to CONF_SECRETS if OpenBao is unreachable.
config/jump-secrets.js becomes an operator-edit seed artifact (OpenBao
authoritative). README gains a Secrets section.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
William Mantly
2026-08-01 12:28:46 -04:00
parent f386a5f9c3
commit 1092031a9f
5 changed files with 83 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nodejs/bin/www
+34 -23
View File
@@ -9,32 +9,43 @@ const http = require('http');
const conf = require('@simpleworkjs/conf');
const { Server } = require('socket.io');
require('../models');
// @simpleworkjs/conf loads ./config/jump-secrets.js synchronously, then
// @simpleworkjs/bao-conf deep-merges secret/jump-host/conf from OpenBao over
// it. The OIDC clientSecret is captured at require time inside models (via
// createOidcClient), so the fetch MUST resolve before require('../models').
// Fail-soft: if OpenBao is unreachable, init() leaves conf as the file-loaded
// fallback and boot continues from ./config/jump-secrets.js.
require('@simpleworkjs/bao-conf').init({ path: 'jump-host', conf }).then(() => {
require('../models');
const app = require('../app');
const middleware = require('../middleware/auth');
const sshServer = require('../services/ssh_server');
const app = require('../app');
const middleware = require('../middleware/auth');
const sshServer = require('../services/ssh_server');
const webPort = (conf.web && conf.web.port) || 3002;
const server = http.createServer(app);
const webPort = (conf.web && conf.web.port) || 3002;
const server = http.createServer(app);
// Socket.IO — the client framework (app-base.js) opens an authenticated socket.
// We don't push anything yet, but serving /socket.io keeps the shared front-end
// working exactly as it does in the sibling apps.
const io = new Server(server);
io.use(middleware.authIO);
app.io = io;
// Socket.IO — the client framework (app-base.js) opens an authenticated socket.
// We don't push anything yet, but serving /socket.io keeps the shared front-end
// working exactly as it does in the sibling apps.
const io = new Server(server);
io.use(middleware.authIO);
app.io = io;
server.listen(webPort, () => {
console.log(`[web] jump-host UI/API on :${server.address().port}`);
});
server.listen(webPort, () => {
console.log(`[web] jump-host UI/API on :${server.address().port}`);
});
sshServer.start();
sshServer.start();
function shutdown() {
console.log('[jump-host] shutting down');
server.close();
process.exit(0);
}
process.on('SIGTERM', shutdown);
process.on('SIGINT', shutdown);
function shutdown() {
console.log('[jump-host] shutting down');
server.close();
process.exit(0);
}
process.on('SIGTERM', shutdown);
process.on('SIGINT', shutdown);
}).catch(err => {
console.error('boot failed:', err);
process.exit(1);
});