vgi.secret_service

Module overview

Standalone serving harness for the VGI secret protocol (Orchard).

Orchard’s secret service is an independently-deployed microservice — separate from the worker/catalog vgi-serve deployable and speaking :class:vgi.secret_protocol.VgiSecretProtocol. This module provides:

• :func:create_secret_app — build a WSGI app for any VgiSecretProtocol implementation (usable with gunicorn/waitress/uwsgi).
• :func:serve_secret_http — run it under waitress (prints PORT:<n> for test harnesses, mirroring :mod:vgi.serve).
• :class:ExampleOrchardSecretService — a reference implementation that returns a canned s3 credential for s3://test-bucket*; the C++ integration tests point vgi-secret-serve at this class.
• :func:main — the vgi-secret-serve CLI entry point.

Auth: identity is carried by the HTTP bearer. Production deployments wire an authenticate callback (reuse the VGI_BEARER_TOKENS / VGI_JWT_* env vars supported by :mod:vgi.serve). The example service ignores identity.

function create_secret_app

source

create_secret_app(
impl: object,
,
prefix: str = ‘’,
cors_origins: str = ‘’,
signing_key: bytes | None = None,
authenticate: Callable[[falcon.Request], Any] | None = None,
oauth_resource_metadata: Any = None,
) -> falcon.App[Any, Any]

Build a WSGI app serving impl over :class:VgiSecretProtocol.

impl is any object implementing secret_lookup(path, type). The default landing/describe pages are disabled — this is a credential endpoint, not a browsable worker.

class ExampleOrchardSecretService

source

Description

Reference :class:VgiSecretProtocol implementation for tests/demos.

Returns a canned s3 credential for any path under s3://test-bucket with a short expires_at_unix (so the min(ttl, expiry) cache path is exercised) and secret marked for redaction. Everything else is a miss.

Attributes

attribute credential_lifetime_seconds

int

Seconds until the canned credential’s intrinsic expiry.

Methods

method secret_lookup

source

secret_lookup(path: str, type: str) -> SecretLookupResponse

Return the canned credential for known test paths; empty otherwise.

function main

source

main() -> None

CLI entry point for vgi-secret-serve.

function serve_secret_http

source

serve_secret_http(
impl: object,
,
host: str = ‘0.0.0.0’,
port: int | None = None,
prefix: str = ‘’,
cors_origins: str = ‘’,
signing_key: bytes | None = None,
authenticate: Callable[…, Any] | None = None,
oauth_resource_metadata: Any = None,
) -> None

Serve impl over HTTP under waitress. Prints PORT:<n> once bound.