awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-06 20:27:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

requested changes

Browse Source 
requested changes

temp: team debugging

Revert "temp: team debugging"

This reverts commit 6533d731f829d79f41bf2f7209e3a636553792b1.

feat: hsm support

Update hsm-service.ts

feat: hsm support
This commit is contained in:
Daniel Hougaard
2024-11-11 21:45:06 +04:00
parent 1041e136fb
commit 395b3d9e05
10 changed files with 654 additions and 348 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/lib/config/env.ts
+5 -34
View File
@@ -166,35 +166,10 @@ const envSchema = z
ENABLE_MSSQL_SECRET_ROTATION_ENCRYPT: zodStrBool.default("true"),
// HSM
HSM_LIB_PATH: zpStr(
z
.string()
.optional()
.transform((val) => {
if (process.env.NODE_ENV === "development") return "/usr/local/lib/softhsm/libsofthsm2.so";
return val;
})
),
HSM_PIN: zpStr(
z
.string()
.optional()
.transform((val) => {
if (process.env.NODE_ENV === "development") return "1234";
return val;
})
),
HSM_KEY_LABEL: zpStr(
z
.string()
.optional()
.transform((val) => {
if (process.env.NODE_ENV === "development") return "auth-app";
return val;
})
),
HSM_SLOT: z.coerce.number().optional().default(0),
HSM_MECHANISM: zpStr(z.string().optional().default("AES_GCM"))
HSM_LIB_PATH: zpStr(z.string().optional()),
HSM_PIN: zpStr(z.string().optional()),
HSM_KEY_LABEL: zpStr(z.string().optional()),
HSM_SLOT: z.coerce.number().optional().default(0)
})
// To ensure that basic encryption is always possible.
.refine(
@@ -218,11 +193,7 @@ const envSchema = z
Boolean(data.SECRET_SCANNING_PRIVATE_KEY) &&
Boolean(data.SECRET_SCANNING_WEBHOOK_SECRET),
isHsmConfigured:
Boolean(data.HSM_LIB_PATH) &&
Boolean(data.HSM_PIN) &&
Boolean(data.HSM_KEY_LABEL) &&
Boolean(data.HSM_MECHANISM) &&
data.HSM_SLOT !== undefined,
Boolean(data.HSM_LIB_PATH) && Boolean(data.HSM_PIN) && Boolean(data.HSM_KEY_LABEL) && data.HSM_SLOT !== undefined,
samlDefaultOrgSlug: data.DEFAULT_SAML_ORG_SLUG,
SECRET_SCANNING_ORG_WHITELIST: data.SECRET_SCANNING_ORG_WHITELIST?.split(",")