drgrove / docker-wkd

A Web Key Directory generating docker image

docker-wkd

A OpenPGP WKD (Web Key Directory) generating docker image.

Usage

ENV VAR	Required	Defaults	Description
MAIL_DOMAIN	*		The domain you'd like to generate key files for. (ex. drgrovellc.com)
DATA_FILE_PATH		/data/keys.txt	The path to the datafile
HU_FOLDER		/data/	The folder you'd like to generate the wkd in

# Make your folders
mkdir data hu .gnupg

# Make your keys.txt file

# This will pull the key from a keyserver and then generate the correct file for WKD.
# If you'd like to provide your own keys use the folder option

echo "C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD # Danny Grove" > data/keys.txt

# Using folder.
gpg --export --armour <FINGERPRINT> > data/<email-username>.asc

docker run --rm \
  -v $PWD/data:/data/ -v $PWD/hu:/root/hu -v $PWD/.gnupg:/root/.gnupg \
  -e MAIL_DOMAIN=drgrovellc.com
  drgrove/wkd

Deploying in Kubernetes

You can use the kustomization provided as a base, but you will need to add a few overrides.

Adding a Key

To add a key to WKD you simpely create a configmap for that key with the label wkd: enroll. The example below with use a configMapGenerator

# kustomization.yaml
...
configMapGenerator:
  - name: mykey
    options:
      labels:
        wkd: 'enroll'
      files:
      - pgp/mykey.asc

Assumed folder structure of above example:

kustomize
|- kustomization.yaml
|- pgp/
   |- mykey.asc

Patching your ingress

The example below is using nginx-ingress-controller. This is binding /.well-known/openpgp to the wkd service.

# ingess.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: wkd
  labels:
    app.kubernetes.io/name: wkd
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  tls:
    - hosts:
      - mywebsite.com
      secretName: mywebsite-tls
  rules:
    - host: mywebsite.com
      http:
        paths:
        - path: /.well-known/openpgpkey/
          pathType: Prefix
          backend:
            service:
              name: wkd
              port:
                number: 80

Cluster Install

If you'd like to be able in aggregate PGP keys that have been installed in other namespaces you can do so by adding cluster-rbac to your install

# kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: wkd
resources:
  - github.com/drGrove/docker-wkd/kustomize/direct
  - github.com/drGrove/docker-wkd/kustomize/cluster-rbac

docker-wkd's Issues

Advanced: `Access-Control-Allow-Origin: *` header is missing

docker-wkd/kustomize/base/default.conf

Line 14 in d5da6ca

add_header Access-Control-Allow-Origin * always;

Possible solution: the above header should be on the whole /.well-known/openpgpkey/ directory.

Failure to build kustomization

$ kustomize build https://github.com/drGrove/docker-wkd/kustomize/advanced?ref=9e0721ef88ed33aac78533bbb5e21f7d9a0c69cd
Error: invalid Kustomization: json: cannot unmarshal string into Go struct field Kustomization.patches of type types.Patch

$ kustomize version
5.0.1

it may have broken with the kustomize 5.0.0 release

Add support for WKD Policy

As per Draft 05 of the RFC, add support for a policy file.