Skip to content

fix: respect env vars in XKS config.sh #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
p0wline wants to merge 3 commits into
base: develop
Choose a base branch
from
Open

fix: respect env vars in XKS config.sh #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d731085
fix: respect env vars in XKS config.sh (use ${VAR:-default})
p0wline Aug 11, 2026
b342e0a
test(server): add auth_verifier.toml fixture for AuthVerifierConfig test
p0wline Aug 11, 2026
10be4a9
Merge remote-tracking branch 'origin/develop' into fix/xks-config-env…
p0wline Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions aws_xks/scripts/utils/config.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
# Change this to your XKS Proxy endpoint to test.
export XKS_PROXY_HOST="localhost:9998"
export XKS_PROXY_HOST="${XKS_PROXY_HOST:-localhost:9998}"
# Change this to the URI_PREFIX of a logical keystore supported by your XKS Proxy.
export URI_PREFIX="aws"
export URI_PREFIX="${URI_PREFIX:-aws}"
# Change this to the Access key ID for request authentication to your logical keystore.
# Valid characters are a-z, A-Z, 0-9, /, - (hyphen), and _ (underscore)
export SIGV4_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE"
export SIGV4_ACCESS_KEY_ID="${SIGV4_ACCESS_KEY_ID:-AKIAIOSFODNN7EXAMPLE}"
# Change this to the Secret access key for request authentication to your logical keystore.
# Secret access key must have between 43 and 64 characters. Valid characters are a-z, A-Z, 0-9, /, +, and =
export SIGV4_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
export SIGV4_SECRET_ACCESS_KEY="${SIGV4_SECRET_ACCESS_KEY:-wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY}"
# Change this to a test key id supported by your logical keystore.
export KEY_ID="aws_xks_kek"
export KEY_ID="${KEY_ID:-aws_xks_kek}"
71 changes: 3 additions & 68 deletions configs/server/auth_verifier.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,69 +1,4 @@
# KMS server configured with Authentication Verifier (auth-verifier)
# as the primary auth method, served over HTTPS.
#
# The KMS server:
# 1. Terminates TLS using a PEM server certificate and private key.
# 2. Validates bearer tokens against the verifier's JWKS endpoint.
# 3. Exposes the Web UI login form (GET /ui/auth_method returns "AUTH_VERIFIER")
# and proxies credentials to the verifier via POST /ui/login_as.
#
# Because kms_public_url uses https://, the session cookie will carry the Secure
# flag — browsers only send it over HTTPS, which is the expected behaviour for
# production. For local dev with a self-signed certificate the KMS client must
# set accept_invalid_certs = true.
#
# Prerequisites:
# - A running Authentication Verifier at auth_verifier_url below.
# - The verifier's JWKS endpoint must be reachable from the KMS server.
# - The TLS cert/key files below must exist (relative to the repo root).
#
# Bound to port 9998 (default KMS port).

default_username = "admin"
kms_public_url = "https://localhost:9998"

[http]
port = 9998
hostname = "0.0.0.0"

[tls]
# Server certificate and private key (PEM). No client CA → server-TLS only
# (no mutual authentication required).
tls_cert_file = "test_data/certificates/client_server/server/kmserver.acme.com.crt"
tls_key_file = "test_data/certificates/client_server/server/kmserver.acme.com.key"

[db]
database_type = "sqlite"
sqlite_path = "./sqlite-data-auth-verifier"
clear_database = false

# ── Authentication Verifier ──────────────────────────────────────────────────
# When both `auth_verifier_url` and `auth_verifier_realm` are set, the
# KMS server:
# 1. Validates bearer tokens against the verifier's JWKS endpoint
# 2. Exposes the Web UI login form (GET /ui/auth_method returns "AUTH_VERIFIER")
# 3. Proxies login credentials to the verifier via POST /ui/login_as
#
# `auth_verifier_accept_invalid_certs` allows the JWKS fetch to target an HTTP
# URL (or a server with a self-signed certificate). In production the verifier
# must be reachable over HTTPS with a valid certificate, and this flag must be
# set to false.
[auth_verifier]
auth_verifier_url = "https://localhost:8443"
auth_verifier_realm = "_"
auth_verifier_accept_invalid_certs = true # dev/test only — never in production

[ui_config]
ui_index_html_folder = "./ui/dist"
# A stable session salt ties the session cookie encryption key to this server's
# public URL, making it deterministic across restarts and portable across
# load-balanced instances.
# Generate your own with: openssl rand -hex 32
ui_session_salt = "change-me-use-openssl-rand-hex-32"

[logging]
rust_log = "info,cosmian_kms=debug"
quiet = false
log_to_syslog = false
environment = "development"
ansi_colors = true
auth_verifier_url = "https://localhost:8443"
auth_verifier_realm = "_"
auth_verifier_accept_invalid_certs = true