Module: Legion::Crypt::Settings

Extended by:
Logging::Helper
Defined in:
lib/legion/crypt/settings.rb

Constant Summary

Constants included from Logging::Helper

Logging::Helper::CompatLogger

Class Method Summary collapse

Methods included from Logging::Helper

handle_exception, log

Class Method Details

.default ⇒ Object 



31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/legion/crypt/settings.rb', line 31

def self.default
  {
    vault:            vault,
    jwt:              jwt,
    tls:              tls,
    cs_encrypt_ready: false,
    dynamic_keys:     true,
    cluster_secret:   nil,
    save_private_key: true,
    read_private_key: true
  }
end

.jwt ⇒ Object 



44
45
46
47
48
49
50
51
52
53
54
 
# File 'lib/legion/crypt/settings.rb', line 44

def self.jwt
  {
    enabled:           true,
    default_algorithm: 'HS256',
    default_ttl:       3600,
    issuer:            'legion',
    verify_expiration: true,
    verify_issuer:     true,
    jwks_tls_verify:   'peer'
  }
end

.spiffe ⇒ Object 



20
21
22
23
24
25
26
27
28
29
 
# File 'lib/legion/crypt/settings.rb', line 20

def self.spiffe
  {
    enabled:             false,
    socket_path:         '/tmp/spire-agent/public/api.sock',
    trust_domain:        'legion.internal',
    workload_id:         nil,
    renewal_window:      0.5,
    allow_x509_fallback: false
  }
end

.tls ⇒ Object 



10
11
12
13
14
15
16
17
18
 
# File 'lib/legion/crypt/settings.rb', line 10

def self.tls
  {
    enabled: false,
    verify:  'peer',
    ca:      nil,
    cert:    nil,
    key:     nil
  }
end

.vault ⇒ Object 



56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
 
# File 'lib/legion/crypt/settings.rb', line 56

def self.vault
  {
    enabled:             !Gem::Specification.find_by_name('vault').nil?,
    protocol:            'http',
    address:             'localhost',
    port:                8200,
    token:               ENV['VAULT_DEV_ROOT_TOKEN_ID'] || ENV['VAULT_TOKEN_ID'] || nil,
    connected:           false,
    renewer_time:        5,
    renewer:             true,
    push_cluster_secret: false,
    read_cluster_secret: false,
    kv_path:             ENV['LEGION_VAULT_KV_PATH'] || 'legion',
    leases:              {},
    default:             nil,
    vault_namespace:     'legionio',
    kerberos:            {
      service_principal: nil,
      auth_path:         'auth/kerberos/login'
    },
    tls:                 {
      verify: 'peer'
    },
    clusters:            {},
    bootstrap_lease_ttl: 300,
    dynamic_rmq_creds:   false,
    dynamic_pg_creds:    false
  }
end