rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Inline OAuth2 signing key in config

Browse Source 
The OAuth2/OIDC server accepted its signing key via a file path
(key-file), while every other PEM key in the probod config (SAML
private key, ACME account key) is embedded inline. Switch the
field to a private-key string so the convention is uniform.

The signing key is operator-supplied material that must outlive
any process restart, so the bootstrap builder now treats
OAUTH2_SERVER_SIGNING_KEY as required and refuses to start
without one; silently minting a fresh key per boot would break
token validation across rollouts. The OAUTH2_SERVER_* env vars
otherwise flow through builder.Build like the existing SAML
block so the new OAuth2Server section is populated end-to-end.

Rework the e2e harness to render its config via bootstrap at
test setup, which removes the static
e2e/console/testdata/config.yaml and the previously generated
test-only PEM file. A per-run RSA key is minted via
bootstrap.GenerateOAuth2SigningKey (kept public for test
tooling) and injected through the builder env map. CI now
passes ACME_ROOT_CA inline instead of mutating a YAML on disk.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-04-21 17:56:00 +02:00
parent a622c610d7
commit c4e81ed092
12 changed files with 288 additions and 170 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
GNUmakefile
View File

@@ -38,7 +38,6 @@ GO_TOOL= $(GO_BASE) tool
TEST_FLAGS?= -race -cover -coverprofile=coverage.out
E2E_CONFIG ?= $(CURDIR)/e2e/console/testdata/config.yaml
E2E_COVER_DIR ?= $(CURDIR)/coverage/e2e
DOCKER_IMAGE_NAME= ghcr.io/getprobo/probo
@@ -129,7 +128,6 @@ test-bench: test ## Run benchmark tests
test-e2e: CGO_ENABLED=1
test-e2e: bin/probod ## Run console e2e tests
PROBO_E2E_BINARY=$(CURDIR)/bin/probod \
PROBO_E2E_CONFIG=$(E2E_CONFIG) \
GOTESTSUM_FORMAT=testname $(GO_TEST) -count=1 ./e2e/console/...
bin/probod-coverage:
@@ -140,7 +138,6 @@ test-e2e-coverage: bin/probod-coverage ## Run e2e tests with coverage
@$(RM) -rf $(E2E_COVER_DIR) && $(MKDIR) -p $(E2E_COVER_DIR)
PROBO_E2E_BINARY=$(CURDIR)/bin/probod-coverage \
PROBO_E2E_COVERDIR=$(E2E_COVER_DIR) \
PROBO_E2E_CONFIG=$(E2E_CONFIG) \
CGO_ENABLED=1 $(GO) test -count=1 -v ./e2e/console/...
$(GO) tool covdata textfmt -i=$(E2E_COVER_DIR) -o=coverage-e2e.out
$(GO) tool cover -html=coverage-e2e.out -o=coverage-e2e.html