mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
f3fbb687d2
Following the earlier AdminShell+CollectionCRUD rewrite (PR #14) which already deleted backend/, backend-go/, cloudformation/, helm-charts/, nginx/, sink/, wasm/, upgrade-impact/, e2e/, migration/, package.json and switched the frontend to a 184K Hanzo-first build, complete the cleanup by deleting the remaining Infisical-era residue: - docs/ (1.0G Infisical mintlify docs) - .env.example, .env.dev.example, .env.migration.example, .env.test.example (legacy Postgres/Redis envs; no Go code references them) - .eslintignore, .husky/ (TS toolchain leftovers) - CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md (Infisical repo boilerplate) Working tree drops from ~1.0G to <600K of content (1.5G total is .git/ which `git gc --aggressive --prune=now` shrinks locally; the remote keeps its history shape — anyone pulling gets the lean checkout). Build + test verification: go build ./... (4 cmd binaries: green) go test ./... -count=1 -short (all packages: ok) Kept: cmd/, pkg/, sdk/, frontend/ (AdminShell), schema/, examples/, root Go (audit.go, auth.go, consensus.go, embed.go, jwks.go, mount.go, versioning.go + tests), Dockerfile, Dockerfile.kms-fetch, Makefile, LLM.md, CLAUDE.md, DEPRECATED.md, SOVEREIGN-KMS-ARCHITECTURE.md, TFHE-KMS-ARCHITECTURE.md, LICENSE, README.md, VERSION, .github/ (8 Hanzo workflows: build, build-kms-fetch, check-fe-ts-and-lint, ci, pr-preview, release, validate-pr-title, workflow-sanity).
62 lines
2.2 KiB
Terraform
62 lines
2.2 KiB
Terraform
# Terraform Outputs for Google Cloud KMS HSM
|
|
|
|
output "instructions" {
|
|
description = "Post-deployment instructions"
|
|
value = <<-EOT
|
|
================================================================================
|
|
Google Cloud KMS HSM Setup Complete!
|
|
================================================================================
|
|
|
|
Resources Created:
|
|
- Project: ${var.project_id}
|
|
- Key Ring: ${google_kms_key_ring.lux_kms.id}
|
|
- Crypto Key: ${google_kms_crypto_key.lux_kms_primary.id}
|
|
- Service Account: ${google_service_account.lux_kms.email}
|
|
- Protection Level: ${var.protection_level}
|
|
|
|
Next Steps:
|
|
|
|
1. Export environment variables:
|
|
export GOOGLE_CLOUD_PROJECT_ID="${var.project_id}"
|
|
export GOOGLE_CLOUD_LOCATION="${var.key_location}"
|
|
export GOOGLE_CLOUD_KEY_RING="${var.key_ring_name}"
|
|
export GOOGLE_CLOUD_CRYPTO_KEY="${var.crypto_key_name}"
|
|
export GOOGLE_APPLICATION_CREDENTIALS="${path.module}/lux-kms-credentials.json"
|
|
|
|
2. Verify setup:
|
|
gcloud kms keys describe ${var.crypto_key_name} \
|
|
--location=${var.key_location} \
|
|
--keyring=${var.key_ring_name}
|
|
|
|
3. Test encryption:
|
|
echo "test data" | gcloud kms encrypt \
|
|
--location=${var.key_location} \
|
|
--keyring=${var.key_ring_name} \
|
|
--key=${var.crypto_key_name} \
|
|
--plaintext-file=- \
|
|
--ciphertext-file=-
|
|
|
|
4. Deploy Lux KMS:
|
|
- Copy .env.example to .env
|
|
- Add environment variables from step 1
|
|
- Run: docker-compose up -d
|
|
|
|
5. Verify Lux KMS health:
|
|
curl http://localhost:8080/health
|
|
|
|
Security Reminders:
|
|
- Store credentials securely (use Secret Manager in production)
|
|
- Enable VPC Service Controls for additional security
|
|
- Review IAM permissions regularly
|
|
- Monitor Cloud Audit Logs for suspicious activity
|
|
- Rotate service account keys every 90 days
|
|
|
|
Documentation:
|
|
- Setup Guide: /docs/kms-configuration/google-cloud-hsm
|
|
- API Reference: /docs/api/hsm-operations
|
|
- Troubleshooting: /docs/troubleshooting/google-cloud-kms
|
|
|
|
================================================================================
|
|
EOT
|
|
}
|