vaultstorage

README

go-eth2-wallet-store-vault

Hashicorp Vault based store for the Ethereum 2 wallet.

Table of Contents

• Install
• Usage
• Maintainers
• Contribute
• License

Install

go-eth2-wallet-store-vault is a standard Go module which can be installed with:

go get github.com/wealdtech/go-eth2-wallet-store-vault

Usage

In normal operation this module should not be used directly. Instead, it should be configured to be used as part of go-eth2-wallet.

The Vault store has the following options:

• vault_addr: the Vault address in which the wallet is to be stored. Exemple: http://localhost:8200 for local vault
• id: an ID that is used to differentiate multiple stores created by the same account. If this is not configured an empty ID is used
• vault_auth: Vault authentication type. Values: token or kubernetes
• vault_token: Vault token to use for requesting vault (Mandatory if vault_auth is token)
• vault_k8s_auth_role: Name of the kubernetes auth role to use (Mandatory if vault_auth is kubernetes)
• vault_k8s_auth_sa_token_path: Local path to access to the kubernetes service account token. Default: /var/run/secrets/kubernetes.io/serviceaccount/token
• vault_k8s_auth_mount_path: Kubernetes auth module path. Default: kubernetes
• vault_secrets_mount_path: KVv2 secrets module path (Mandatory)
• passphrase: a key used to encrypt all data written to the store. If this is not configured data is written to the store unencrypted (although wallet- and account-specific private information may be protected by their own passphrases)

When initiating a connection to Amazon S3 the Amazon credentials are required. Details on how to make the credentials available to the store are available at the Amazon S3 documentation

Example

package main

import (
	e2wallet "github.com/wealdtech/go-eth2-wallet"
	vault "github.com/bliiitz/go-eth2-wallet-store-vault"
)

func main() {
    // Set up and use an encrypted store
    store, err := vault.New(vault.WithPassphrase([]byte("my secret")))
    if err != nil {
        panic(err)
    }
    e2wallet.UseStore(store)

    // Set up and use an encrypted store in the central Canada region
    store, err = vault.New(vault.WithPassphrase([]byte("my secret")), vault.WithRegion("ca-central-1"))
    if err != nil {
        panic(err)
    }
    e2wallet.UseStore(store)

    // Set up and use an encrypted store with a custom ID
    store, err = vault.New(vault.WithPassphrase([]byte("my secret")), vault.WithID([]byte("store 2")))
    if err != nil {
        panic(err)
    }
    e2wallet.UseStore(store)
}

Maintainers

Bliiitz: @bliiitz.

Contribute

Contributions welcome. Please check out the issues.

License

Apache-2.0 © 2022 Bliiitz

Documentation

Index

• func New(opts ...Option) (wtypes.Store, error)
• type Option
  • func WithID(t []byte) Option
  • func WithPassphrase(passphrase []byte) Option
  • func WithVaultAddr(t string) Option
  • func WithVaultAuth(t string) Option
  • func WithVaultKubernetesAuth(t string) Option
  • func WithVaultKubernetesAuthRole(t string) Option
  • func WithVaultKubernetesAuthSATokenPath(t string) Option
  • func WithVaultSecretMountPath(t string) Option
  • func WithVaultToken(t string) Option
• type Store
  • func (s *Store) Location() string
  • func (s *Store) Name() string
  • func (s *Store) RetrieveAccount(walletID uuid.UUID, accountID uuid.UUID) ([]byte, error)
  • func (s *Store) RetrieveAccounts(walletID uuid.UUID) <-chan []byte
  • func (s *Store) RetrieveAccountsIndex(walletID uuid.UUID) ([]byte, error)
  • func (s *Store) RetrieveWallet(walletName string) ([]byte, error)
  • func (s *Store) RetrieveWalletByID(walletID uuid.UUID) ([]byte, error)
  • func (s *Store) RetrieveWallets() <-chan []byte
  • func (s *Store) StoreAccount(walletID uuid.UUID, accountID uuid.UUID, data []byte) error
  • func (s *Store) StoreAccountsIndex(walletID uuid.UUID, data []byte) error
  • func (s *Store) StoreWallet(id uuid.UUID, name string, data []byte) error
• type WalletIndexSecret
• type WalletListSecret
• type WalletSecret

Functions

func New

func New(opts ...Option) (wtypes.Store, error)

New creates a new Amazon S3 store. This takes the following options:

• region: a string specifying the Amazon S3 region, defaults to "us-east-1", set with WithRegion()
• id: a byte array specifying an identifying key for the store, defaults to nil, set with WithID()

This expects the access credentials to be in a standard place, e.g. ~/.aws/credentials

Types

type Option

type Option interface {
	// contains filtered or unexported methods
}

Option gives options to New

func WithID

func WithID(t []byte) Option

WithID sets the ID for the store

func WithPassphrase

func WithPassphrase(passphrase []byte) Option

WithPassphrase sets the passphrase for the store.

func WithVaultAddr

func WithVaultAddr(t string) Option

WithID sets the ID for the store

func WithVaultAuth

func WithVaultAuth(t string) Option

WithID sets the ID for the store

func WithVaultKubernetesAuth

func WithVaultKubernetesAuth(t string) Option

WithID sets the ID for the store

func WithVaultKubernetesAuthRole

func WithVaultKubernetesAuthRole(t string) Option

WithID sets the ID for the store

func WithVaultKubernetesAuthSATokenPath

func WithVaultKubernetesAuthSATokenPath(t string) Option

WithID sets the ID for the store

func WithVaultSecretMountPath

func WithVaultSecretMountPath(t string) Option

WithID sets the ID for the store

func WithVaultToken

func WithVaultToken(t string) Option

WithID sets the ID for the store

type Store

type Store struct {
	// contains filtered or unexported fields
}

Store is the store for the wallet held encrypted on Amazon S3.

func (*Store) Location

func (s *Store) Location() string

Location returns the location of this store.

func (*Store) Name

func (s *Store) Name() string

Name returns the name of this store.

func (*Store) RetrieveAccount

func (s *Store) RetrieveAccount(walletID uuid.UUID, accountID uuid.UUID) ([]byte, error)

RetrieveAccount retrieves account-level data. It will fail if it cannot retrieve the data.

func (*Store) RetrieveAccounts

func (s *Store) RetrieveAccounts(walletID uuid.UUID) <-chan []byte

RetrieveAccounts retrieves all account-level data for a wallet.

func (*Store) RetrieveAccountsIndex

func (s *Store) RetrieveAccountsIndex(walletID uuid.UUID) ([]byte, error)

RetrieveAccountsIndex retrieves the account index.

func (*Store) RetrieveWallet

func (s *Store) RetrieveWallet(walletName string) ([]byte, error)

RetrieveWallet retrieves wallet-level data. It will fail if it cannot retrieve the data.

func (*Store) RetrieveWalletByID

func (s *Store) RetrieveWalletByID(walletID uuid.UUID) ([]byte, error)

RetrieveWalletByID retrieves wallet-level data. It will fail if it cannot retrieve the data.

func (*Store) RetrieveWallets

func (s *Store) RetrieveWallets() <-chan []byte

RetrieveWallets retrieves wallet-level data for all wallets.

func (*Store) StoreAccount

func (s *Store) StoreAccount(walletID uuid.UUID, accountID uuid.UUID, data []byte) error

StoreAccount stores an account. It will fail if it cannot store the data. Note this will overwrite an existing account with the same ID. It will not, however, allow multiple accounts with the same name to co-exist in the same wallet.

func (*Store) StoreAccountsIndex

func (s *Store) StoreAccountsIndex(walletID uuid.UUID, data []byte) error

StoreAccountsIndex stores the account index.

func (*Store) StoreWallet

func (s *Store) StoreWallet(id uuid.UUID, name string, data []byte) error

StoreWallet stores wallet-level data. It will fail if it cannot store the data. Note that this will overwrite any existing data; it is up to higher-level functions to check for the presence of a wallet with the wallet name and handle clashes accordingly.

type WalletIndexSecret

type WalletIndexSecret struct {
	// contains filtered or unexported fields
}

type WalletListSecret

type WalletListSecret struct {
	// contains filtered or unexported fields
}

type WalletSecret

type WalletSecret struct {
	// contains filtered or unexported fields
}