mirror of https://github.com/hanzoai/kms.git synced 2026-10-17 11:18:16 +00:00

Files

T

zeekay f3fbb687d2 purge: rip remaining Infisical residue — docs, env examples, repo boilerplate

Following the earlier AdminShell+CollectionCRUD rewrite (PR #14) which
already deleted backend/, backend-go/, cloudformation/, helm-charts/,
nginx/, sink/, wasm/, upgrade-impact/, e2e/, migration/, package.json
and switched the frontend to a 184K Hanzo-first build, complete the
cleanup by deleting the remaining Infisical-era residue:

  - docs/                                   (1.0G Infisical mintlify docs)
  - .env.example, .env.dev.example,
    .env.migration.example, .env.test.example
                                            (legacy Postgres/Redis envs;
                                             no Go code references them)
  - .eslintignore, .husky/                  (TS toolchain leftovers)
  - CODE_OF_CONDUCT.md, CONTRIBUTING.md,
    SECURITY.md                             (Infisical repo boilerplate)

Working tree drops from ~1.0G to <600K of content (1.5G total is .git/
which `git gc --aggressive --prune=now` shrinks locally; the remote
keeps its history shape — anyone pulling gets the lean checkout).

Build + test verification:
  go build ./...                            (4 cmd binaries: green)
  go test ./... -count=1 -short             (all packages: ok)

Kept: cmd/, pkg/, sdk/, frontend/ (AdminShell), schema/, examples/,
root Go (audit.go, auth.go, consensus.go, embed.go, jwks.go, mount.go,
versioning.go + tests), Dockerfile, Dockerfile.kms-fetch, Makefile,
LLM.md, CLAUDE.md, DEPRECATED.md, SOVEREIGN-KMS-ARCHITECTURE.md,
TFHE-KMS-ARCHITECTURE.md, LICENSE, README.md, VERSION, .github/
(8 Hanzo workflows: build, build-kms-fetch, check-fe-ts-and-lint,
ci, pr-preview, release, validate-pr-title, workflow-sanity).

2026-06-07 14:23:12 -07:00

1.7 KiB

Raw Blame History

DEPRECATED — Use luxfi/kms

hanzoai/kms is deprecated. The canonical Lux KMS implementation lives at:

Code: https://github.com/luxfi/kms
Image: ghcr.io/luxfi/kms:server-0d446b0 (latest from in-cluster build)
Go module: github.com/luxfi/kms

This repo is archived as kms-v1 for historical reference. The active implementation is Go-native, MPC-backed, ZapDB-storage — replacing the Infisical fork entirely.

Migration

Old	New
`ghcr.io/hanzoai/kms:*`	`ghcr.io/luxfi/kms:server`
`github.com/hanzoai/kms` (Go import)	`github.com/luxfi/kms`
`kms.hanzo.ai` (Infisical UI)	`api.kms.svc.cluster.local` (HTTP)
In-cluster KMS HTTP	`kms.lux-kms-go.svc.cluster.local`
In-cluster ZAP transport	`zap.kms.svc.cluster.local:9999`

Canonical Go client

import "github.com/luxfi/kms"

// One line at process start:
func main() {
    kms.LoadEnv()                       // populates os.Setenv from KMS via ZAP
    db := os.Getenv("DATABASE_URL")
    run(db)
}

// Or programmatic:
v, err   := kms.Get(ctx, "DATABASE_URL")
all, err := kms.GetSecrets(ctx)

Why

The Infisical fork (Node.js + PostgreSQL + Redis + complex web UI) was incompatible with the "one and only one way" architectural principle. The Go-native implementation:

Pure Go binary, no Node.js / Postgres / Redis dependencies
ZapDB embedded storage, age-encrypted S3 replication
Native ZAP binary transport (port 9999) — no REST round-trip in-cluster
MPC-backed envelope encryption via luxfi/mpc threshold signing
KMSSecret CRD operator pulls secrets via ZAP into K8s Secrets

All KMSSecret CRDs across hanzo-k8s and lux-k8s already point at the canonical Lux KMS as of 2026-04-26.

1.7 KiB Raw Blame History

DEPRECATED — Use luxfi/kms

Migration

Canonical Go client

Why

1.7 KiB

Raw Blame History