mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
f3fbb687d2
Following the earlier AdminShell+CollectionCRUD rewrite (PR #14) which already deleted backend/, backend-go/, cloudformation/, helm-charts/, nginx/, sink/, wasm/, upgrade-impact/, e2e/, migration/, package.json and switched the frontend to a 184K Hanzo-first build, complete the cleanup by deleting the remaining Infisical-era residue: - docs/ (1.0G Infisical mintlify docs) - .env.example, .env.dev.example, .env.migration.example, .env.test.example (legacy Postgres/Redis envs; no Go code references them) - .eslintignore, .husky/ (TS toolchain leftovers) - CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md (Infisical repo boilerplate) Working tree drops from ~1.0G to <600K of content (1.5G total is .git/ which `git gc --aggressive --prune=now` shrinks locally; the remote keeps its history shape — anyone pulling gets the lean checkout). Build + test verification: go build ./... (4 cmd binaries: green) go test ./... -count=1 -short (all packages: ok) Kept: cmd/, pkg/, sdk/, frontend/ (AdminShell), schema/, examples/, root Go (audit.go, auth.go, consensus.go, embed.go, jwks.go, mount.go, versioning.go + tests), Dockerfile, Dockerfile.kms-fetch, Makefile, LLM.md, CLAUDE.md, DEPRECATED.md, SOVEREIGN-KMS-ARCHITECTURE.md, TFHE-KMS-ARCHITECTURE.md, LICENSE, README.md, VERSION, .github/ (8 Hanzo workflows: build, build-kms-fetch, check-fe-ts-and-lint, ci, pr-preview, release, validate-pr-title, workflow-sanity).
68 lines
1.9 KiB
Go
68 lines
1.9 KiB
Go
// Copyright (C) 2020-2026, Hanzo AI Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
// Command basic demonstrates the ZK-KMS client SDK.
|
|
//
|
|
// All encryption and decryption happens client-side. The CEK (Customer
|
|
// Encryption Key) is derived from the passphrase and never leaves the client.
|
|
// MPC nodes only store encrypted blobs.
|
|
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
|
|
kms "github.com/hanzoai/kms/sdk/go"
|
|
)
|
|
|
|
func main() {
|
|
client, err := kms.NewClient(kms.Config{
|
|
Nodes: []string{"https://kms-mpc-0:9999", "https://kms-mpc-1:9999", "https://kms-mpc-2:9999"},
|
|
OrgSlug: "hanzo",
|
|
Threshold: 2,
|
|
})
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
|
|
// First time: bootstrap creates the org and derives the master key.
|
|
// client.Bootstrap("super-secret-passphrase")
|
|
|
|
// Unlock derives the CEK client-side from the passphrase.
|
|
// The passphrase is never transmitted to any node.
|
|
if err := client.Unlock("super-secret-passphrase"); err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
defer client.Lock() // zeros CEK from memory
|
|
|
|
// Set a secret — encrypted client-side with CEK, stored on MPC nodes.
|
|
// Nodes never see the plaintext value or the key name.
|
|
if err := client.Set("DATABASE_URL", []byte("postgresql://user:pass@db:5432/app")); err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
fmt.Println("Set DATABASE_URL (encrypted on MPC nodes)")
|
|
|
|
// Get a secret — fetched as encrypted blob, decrypted client-side.
|
|
val, err := client.Get("DATABASE_URL")
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
fmt.Printf("DATABASE_URL = %s\n", val)
|
|
|
|
// List all secrets — names are encrypted on nodes, decrypted client-side.
|
|
names, err := client.List()
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
fmt.Printf("Secrets: %v\n", names)
|
|
|
|
// Check MPC node health.
|
|
statuses, err := client.Status()
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
for _, s := range statuses {
|
|
fmt.Printf("Node %s: healthy=%v latency=%dms\n", s.Address, s.Healthy, s.Latency)
|
|
}
|
|
}
|