1 files changed, 37 insertions, 55 deletions

diff --git a/app/config.go b/app/config.go
index 6565863..b8c8d51 100644
--- a/app/config.go
+++ b/app/config.go
@@ -1,12 +1,7 @@
 package app
 
 import (
-        "log"
         "time"
-
-        "code.crute.us/mcrute/golib/cli"
-        "code.crute.us/mcrute/golib/vault"
-        "github.com/spf13/cobra"
 )
 
 type GitHubOauthCreds struct {
@@ -15,56 +10,43 @@ type GitHubOauthCreds struct {
 }
 
 type Config struct {
-        Bind                  []string
-        BindTLS               []string
-        Debug                 bool
-        TemplateGlob          string
-        TemplatePath          string
-        MongoDbUri            string
-        MongodbVaultPath      string
-        LogFile               string
-        TLSCacheDir           string
-        TrustedIPRanges       []string
-        ManagementIPRanges    []string
-        Hostnames             []string
-        DisableBackgroundJobs bool
-        RateLimit             time.Duration
-        RateLimitBurst        int
-        IssuerEndpoint        string
-        JWTAudience           string
-        AuthCookieDuration    time.Duration
-        GitHubOauthCreds      *GitHubOauthCreds
+        Bind                  []string      `flag:"bind" flag-scope:"web" flag-help:"Addresses and ports to bind http server"`
+        Debug                 bool          `flag:"debug" flag-help:"Enable debug mode"`
+        MongoDbUri            string        `flag:"mongodb-uri" flag-help:"URI for connection to mongodb"`
+        LogFile               string        `flag:"log-file" flag-scope:"web" flag-help:"Log file for combined host logs"`
+        TrustedIPRanges       []string      `flag:"trusted-ip-ranges" flag-scope:"web" flag-help:"Comma separated list of IP ranges for trusted XFF proxies"`
+        Hostnames             []string      `flag:"hostname" flag-scope:"web" flag-help:"Hostname this server serves (can be specified multiple times)"`
+        DisableBackgroundJobs bool          `flag:"disable-bg-jobs" flag-help:"Disable background jobs and only serve web pages"`
+        RateLimit             time.Duration `flag:"rate-limit" flag-help:"Number seconds between requests for credential resources"`
+        RateLimitBurst        int           `flag:"rate-limit-burst" flag-help:"Number of burst requests allowed to credential endpoints"`
+        IssuerEndpoint        string        `flag:"issuer-endpoint" flag-help:"Oauth issuer endpoint"`
+        JWTAudience           string        `flag:"jwt-audience" flag-help:"Audience for issued JWTs"`
+        AuthCookieDuration    time.Duration `flag:"auth-cookie-duration" flag-help:"Expiration duration of the auth cookies"`
+        GitHubOauthCreds      string        `flag:"github-oauth-vault-path" flag-help:"Vault material name for GitHub auth credentials"`
+        DNSApiKeyVaultPath    string        `flag:"dns-api-vault-path" flag-help:"Vault material for DNS API key"`
+        AutocertEmail         string        `flag:"autocert-email" flag-scope:"web" flag-help:"Autocert notification email"`
+        AutocertHost          string        `flag:"autocert-host" flag-scope:"web" flag-help:"Autocert service url"`
+        NetboxHost            string        `flag:"netbox-host" flag-scope:"web" flag-help:"Netbox service url"`
+        NetboxApiKeyVaultPath string        `flag:"netbox-api-vault-path" flag-scope:"web" flag-help:"Vault material path for Netbox API key"`
 }
 
-func NewConfigFromCmd(cmd *cobra.Command) Config {
-        f := cli.TolerantPflagSet{cmd.Flags()}
-
-        var githubOauth GitHubOauthCreds
-        oauthPath := f.MayGetString("github-oauth-vault-path")
-        err := vault.GetVaultKeyStruct(oauthPath, &githubOauth)
-        if err != nil {
-                log.Fatalf("Error getting %s from vault: %w", oauthPath, err)
-        }
-
-        return Config{
-                Bind:                  f.MayGetStringSlice("bind"),
-                BindTLS:               f.MayGetStringSlice("bind-tls"),
-                Debug:                 f.MayGetBool("debug"),
-                TemplateGlob:          f.MayGetString("template-glob"),
-                TemplatePath:          f.MayGetString("template-path"),
-                MongoDbUri:            f.MayGetString("mongodb-uri"),
-                MongodbVaultPath:      f.MayGetString("mongodb-vault-path"),
-                DisableBackgroundJobs: f.MayGetBool("disable-bg-jobs"),
-                TrustedIPRanges:       f.MayGetStringSlice("trusted-ip-ranges"),
-                ManagementIPRanges:    f.MayGetStringSlice("management-ip-ranges"),
-                Hostnames:             f.MayGetStringSlice("hostname"),
-                LogFile:               f.MayGetString("log-file"),
-                TLSCacheDir:           f.MayGetString("tls-cache-dir"),
-                RateLimit:             f.MayGetDuration("rate-limit"),
-                RateLimitBurst:        f.MayGetInt("rate-limit-burst"),
-                IssuerEndpoint:        f.MayGetString("issuer-endpoint"),
-                JWTAudience:           f.MayGetString("jwt-audience"),
-                AuthCookieDuration:    f.MayGetDuration("auth-cookie-duration"),
-                GitHubOauthCreds:      &githubOauth,
-        }
+var DefaultConfig = &Config{
+        Bind:                  []string{":8169"},
+        Debug:                 false,
+        MongoDbUri:            "cloud-id-broker-prod-dynamic@mongodb.sea4.crute.me/cloud-id-broker-prod",
+        LogFile:               "",
+        TrustedIPRanges:       []string{"172.19.0.0/22", "2602:803:4072::/48"},
+        Hostnames:             []string{"aws-access.crute.me"},
+        DisableBackgroundJobs: false,
+        RateLimit:             30 * time.Second,
+        RateLimitBurst:        30,
+        IssuerEndpoint:        "https://aws-access.crute.me",
+        JWTAudience:           "aws-access",
+        AuthCookieDuration:    24 * time.Hour,
+        GitHubOauthCreds:      "service/aws-access/github-oauth",
+        DNSApiKeyVaultPath:    "service/aws-access/dns-api-key",
+        AutocertEmail:         "letsencrypt-certs@pomonaconsulting.com",
+        AutocertHost:          "https://dns-manage.crute.me/acmev2",
+        NetboxHost:            "https://netbox.crute.me",
+        NetboxApiKeyVaultPath: "infra/netbox-readonly",
 }