tile,config: serve redacted config export on the log index page (#8)

Add config.Config.Redacted(), a public-safe view of the running
configuration built as an allowlist: only fields that are neither
secrets, filesystem paths, nor internal bind addresses are copied
across, so a newly added field is excluded by default rather than
leaking by accident. Dropped: data_dir, all seed/key/TLS paths, every
*_path field, and the acme/monitoring/metrics/sign-subtree listen
addresses (only external_url values are exposed).

cmd/cactus marshals cfg.Redacted() and hands the JSON to the tile
server via WithConfigJSON; the read-path server stays decoupled from
config and just serves the bytes at GET /config (404 when unset). The
browser UI gains a collapsible Configuration panel that fetches and
displays it.

Tests: a leak guard fills every secret/path/listen field with a
sentinel and asserts none survive redaction; tile tests cover /config
enabled and disabled.

Author: mcpherrinm

cmd/cactus/main.go

@@ -28,6 +28,7 @@ import (
 	"syscall"
 	"time"
 
+	"encoding/json"
 	"encoding/pem"
 	"strings"
 
@@ -361,6 +362,13 @@ func run(cfg config.Config, logger *slog.Logger) error {
 		MaxHeaderBytes:    16 * 1024,
 	}
 	tileSrv := tile.New(l, fsRoot).WithLandmarks(landmarkSeq)
+	// Expose a redacted (no paths, no secrets) export of the running config
+	// on the log's browser UI. Marshal failures are non-fatal: just skip it.
+	if cfgJSON, err := json.MarshalIndent(cfg.Redacted(), "", "  "); err != nil {
+		logger.Warn("could not marshal redacted config for /config endpoint", "err", err)
+	} else {
+		tileSrv = tileSrv.WithConfigJSON(cfgJSON)
+	}
 	monMux := http.NewServeMux()
 	monMux.HandleFunc("/ca-certificate", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/pem-certificate-chain")

config/config_test.go

@@ -1,8 +1,10 @@
 package config
 
 import (
+	"encoding/json"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -73,3 +75,69 @@ func TestValidationErrors(t *testing.T) {
 		})
 	}
 }
+
+// TestRedactedOmitsSecretsAndPaths fills every secret/path-bearing field with a
+// recognizable sentinel, then asserts none of those sentinels survive into the
+// JSON of Redacted(). Because Redacted() is an allowlist, this also guards
+// against a future path/secret field being copied across by mistake.
+func TestRedactedOmitsSecretsAndPaths(t *testing.T) {
+	const secret = "SENSITIVE-DO-NOT-LEAK"
+	c := Config{
+		DataDir: "/var/lib/" + secret,
+		CACosigner: CosignerConfig{
+			ID:        "id-ca",
+			Algorithm: "mldsa-44",
+			SeedPath:  "keys/" + secret,
+		},
+		ACME: ACMEConfig{
+			Listen:        secret + ":14000",
+			ExternalURL:   "https://example.test",
+			TLSCert:       "tls/" + secret + ".crt",
+			TLSKey:        "tls/" + secret + ".key",
+			ChallengeMode: "auto-pass",
+		},
+		Monitoring: ListenerConfig{
+			Listen:      secret + ":14080",
+			ExternalURL: "https://mon.test",
+		},
+		Metrics: MetricsConfig{Listen: secret + ":14090"},
+		CACosignerQuorum: CACosignerQuorum{
+			Mirrors: []MirrorEndpointConfig{{
+				ID:            "id-mirror",
+				URL:           "https://mirror.test",
+				Algorithm:     "mldsa-44",
+				PublicKeyPath: "keys/" + secret,
+			}},
+			MinSignatures: 1,
+		},
+		Mirror: MirrorConfig{
+			Enabled:    true,
+			CosignerID: "id-mirror-cosigner",
+			Algorithm:  "mldsa-44",
+			SeedPath:   "keys/" + secret,
+			Upstream: UpstreamConfig{
+				TileURL:           "https://upstream.test",
+				LogID:             "id-log",
+				CACosignerID:      "id-upstream-ca",
+				CACosignerKeyPath: "keys/" + secret,
+				PollIntervalMS:    1000,
+			},
+			SignSubtreeListen: secret + ":14070",
+			SignSubtreePath:   "/sign-subtree",
+		},
+	}
+
+	out, err := json.Marshal(c.Redacted())
+	if err != nil {
+		t.Fatalf("marshal redacted config: %v", err)
+	}
+	if strings.Contains(string(out), secret) {
+		t.Fatalf("redacted config leaked a secret/path sentinel:\n%s", out)
+	}
+
+	// Sanity: a non-sensitive field still comes through, so the test would
+	// actually catch a leak rather than passing on an empty result.
+	if !strings.Contains(string(out), "https://example.test") {
+		t.Fatalf("redacted config dropped a public field; got:\n%s", out)
+	}
+}

config/redacted.go

@@ -0,0 +1,120 @@
+package config
+
+// RedactedConfig is a public-safe view of Config, suitable for serving on the
+// log's HTML index page. It is built by an *allowlist*: only fields that are
+// neither secrets nor filesystem paths are copied across. A newly added field
+// is therefore excluded by default — it has to be added here explicitly to be
+// exposed — so a future secret can't leak by accident. Everything path-like is
+// intentionally absent: data_dir, ca_cosigner.seed_path, acme.tls_cert /
+// tls_key, every *.public_key_path / ca_cosigner_key_path, mirror.seed_path.
+//
+// Internal bind addresses (acme.listen, monitoring.listen, metrics.listen,
+// mirror.sign_subtree_listen) are also dropped; only the public external_url
+// values are exposed. sign_subtree_path is an HTTP route, not a bind address
+// or filesystem path, so it is kept. The metrics section has nothing left to
+// expose once its listen address is dropped, so it is omitted entirely.
+type RedactedConfig struct {
+	Log              LogConfig        `json:"log"`
+	CACosigner       RedactedCosigner `json:"ca_cosigner"`
+	CACosignerQuorum RedactedQuorum   `json:"ca_cosigner_quorum"`
+	ACME             RedactedACME     `json:"acme"`
+	Monitoring       RedactedListener `json:"monitoring"`
+	Landmarks        LandmarkConfig   `json:"landmarks"`
+	Mirror           RedactedMirror   `json:"mirror"`
+	LogLevel         string           `json:"log_level"`
+}
+
+// RedactedCosigner drops CosignerConfig.SeedPath.
+type RedactedCosigner struct {
+	ID        string `json:"id"`
+	Algorithm string `json:"algorithm"`
+}
+
+// RedactedACME drops ACMEConfig.TLSCert, TLSKey, and the internal Listen
+// address.
+type RedactedACME struct {
+	ExternalURL   string `json:"external_url"`
+	ChallengeMode string `json:"challenge_mode"`
+}
+
+// RedactedListener drops ListenerConfig.Listen (the internal bind address).
+type RedactedListener struct {
+	ExternalURL string `json:"external_url"`
+}
+
+// RedactedQuorum mirrors CACosignerQuorum but with redacted endpoints.
+type RedactedQuorum struct {
+	Mirrors                []RedactedMirrorEndpoint `json:"mirrors"`
+	MinSignatures          int                      `json:"min_signatures"`
+	RequestTimeoutMS       int                      `json:"request_timeout_ms"`
+	BestEffortAfterMinimum bool                     `json:"best_effort_after_minimum"`
+	MirrorRetryDeadlineMS  int                      `json:"mirror_retry_deadline_ms"`
+}
+
+// RedactedMirrorEndpoint drops MirrorEndpointConfig.PublicKeyPath.
+type RedactedMirrorEndpoint struct {
+	ID        string `json:"id"`
+	URL       string `json:"url"`
+	Algorithm string `json:"algorithm"`
+}
+
+// RedactedMirror drops MirrorConfig.SeedPath and the internal
+// SignSubtreeListen bind address.
+type RedactedMirror struct {
+	Enabled                     bool             `json:"enabled"`
+	CosignerID                  string           `json:"cosigner_id"`
+	Algorithm                   string           `json:"algorithm"`
+	Upstream                    RedactedUpstream `json:"upstream"`
+	SignSubtreePath             string           `json:"sign_subtree_path"`
+	RequireCASignatureOnSubtree bool             `json:"require_ca_signature_on_subtree"`
+}
+
+// RedactedUpstream drops UpstreamConfig.CACosignerKeyPath.
+type RedactedUpstream struct {
+	TileURL        string `json:"tile_url"`
+	LogID          string `json:"log_id"`
+	CACosignerID   string `json:"ca_cosigner_id"`
+	PollIntervalMS int    `json:"poll_interval_ms"`
+}
+
+// Redacted returns the public-safe view of c. See RedactedConfig.
+func (c Config) Redacted() RedactedConfig {
+	rc := RedactedConfig{
+		Log:        c.Log,
+		CACosigner: RedactedCosigner{ID: c.CACosigner.ID, Algorithm: c.CACosigner.Algorithm},
+		CACosignerQuorum: RedactedQuorum{
+			MinSignatures:          c.CACosignerQuorum.MinSignatures,
+			RequestTimeoutMS:       c.CACosignerQuorum.RequestTimeoutMS,
+			BestEffortAfterMinimum: c.CACosignerQuorum.BestEffortAfterMinimum,
+			MirrorRetryDeadlineMS:  c.CACosignerQuorum.MirrorRetryDeadlineMS,
+		},
+		ACME: RedactedACME{
+			ExternalURL:   c.ACME.ExternalURL,
+			ChallengeMode: c.ACME.ChallengeMode,
+		},
+		Monitoring: RedactedListener{ExternalURL: c.Monitoring.ExternalURL},
+		Landmarks:  c.Landmarks,
+		Mirror: RedactedMirror{
+			Enabled:                     c.Mirror.Enabled,
+			CosignerID:                  c.Mirror.CosignerID,
+			Algorithm:                   c.Mirror.Algorithm,
+			SignSubtreePath:             c.Mirror.SignSubtreePath,
+			RequireCASignatureOnSubtree: c.Mirror.RequireCASignatureOnSubtree,
+			Upstream: RedactedUpstream{
+				TileURL:        c.Mirror.Upstream.TileURL,
+				LogID:          c.Mirror.Upstream.LogID,
+				CACosignerID:   c.Mirror.Upstream.CACosignerID,
+				PollIntervalMS: c.Mirror.Upstream.PollIntervalMS,
+			},
+		},
+		LogLevel: c.LogLevel,
+	}
+	for _, m := range c.CACosignerQuorum.Mirrors {
+		rc.CACosignerQuorum.Mirrors = append(rc.CACosignerQuorum.Mirrors, RedactedMirrorEndpoint{
+			ID:        m.ID,
+			URL:       m.URL,
+			Algorithm: m.Algorithm,
+		})
+	}
+	return rc
+}

tile/app.js

@@ -101,6 +101,25 @@ async function loadCheckpoint() {
   }
 }
 
+// ---- config -------------------------------------------------------------
+
+// Fetch the redacted config export (see config.Config.Redacted) and show it in
+// the Configuration panel. The endpoint is optional, so hide the panel if it
+// isn't served or the fetch fails.
+async function loadConfig() {
+  const panel = $("configpanel");
+  if (!panel) return;
+  try {
+    const r = await fetch("config", { cache: "no-store" });
+    if (!r.ok) { panel.style.display = "none"; return; }
+    const text = await r.text();
+    $("configout").textContent = text;
+    panel.style.display = "";
+  } catch {
+    panel.style.display = "none";
+  }
+}
+
 // ---- tile browser -------------------------------------------------------
 
 function tileChip(level, index, width) {
@@ -815,6 +834,7 @@ function init() {
 
   populateLevels(); // seed the dropdown before the first checkpoint loads
   loadCheckpoint();
+  loadConfig();
 }
 
 // Auto-run in the browser; stay inert under Bun (which sets the test flag
@@ -824,7 +844,7 @@ if (typeof document !== "undefined" && !globalThis.__CACTUS_TEST__) init();
 if (typeof module !== "undefined" && module.exports) {
   module.exports = {
     TILE_W, formatTileIndex, tileURL, treeHeight, tileLevels, tileWidth,
-    loadCheckpoint, renderTileLists, populateLevels, selectAndFetch, drillDown,
+    loadCheckpoint, loadConfig, renderTileLists, populateLevels, selectAndFetch, drillDown,
     openEntry, fetchTile, renderHashTile, splitDataTile, renderEntriesTile, fetchEntry,
     DER, tagName, decodeOID, oidName, decodeDN, decodeSAN, hexPreview,
     previewInteger, formatTime, previewPrimitive, derNode, derForest,

tile/index.html

@@ -173,6 +173,15 @@ <h2>Entry viewer</h2>
     </div>
   </div>
 
+  <div class="panel" id="configpanel" style="display:none">
+    <details>
+      <summary style="cursor:pointer"><span style="color:var(--accent)">Configuration</span></summary>
+      <p class="hint" style="margin-top:.6rem">Redacted export of the running server
+        configuration — filesystem paths and key material are omitted.</p>
+      <div id="configout" class="out"></div>
+    </details>
+  </div>
+
   <p class="note">cactus monitoring read-path · tlog-tiles layout. This is a test
     server; see the threat model before trusting anything here.</p>
 </div>

tile/server.go

@@ -32,9 +32,10 @@ var appJS []byte
 
 // Server is the read-path HTTP handler.
 type Server struct {
-	log       *log.Log
-	fs        storage.FS
-	landmarks *landmark.Sequence // optional; nil disables /landmarks
+	log        *log.Log
+	fs         storage.FS
+	landmarks  *landmark.Sequence // optional; nil disables /landmarks
+	configJSON []byte             // optional; nil disables /config
 }
 
 // New returns a Server backed by l and fs.
@@ -49,20 +50,34 @@ func (s *Server) WithLandmarks(seq *landmark.Sequence) *Server {
 	return s
 }
 
+// WithConfigJSON attaches a redacted, public-safe JSON export of the running
+// configuration (see config.Config.Redacted) so the server exposes it at
+// /config and the browser UI can display it. The bytes are served verbatim,
+// so the caller is responsible for the redaction; passing nil leaves /config
+// disabled.
+func (s *Server) WithConfigJSON(j []byte) *Server {
+	s.configJSON = j
+	return s
+}
+
 // Handler returns the HTTP handler. Routes:
 //
 //	GET /                      — browser UI (index.html)
 //	GET /app.js                — browser UI logic
 //	GET /checkpoint            — latest signed note
 //	GET /tile/<L>/<NNN..>      — hash tiles (c2sp tlog-tiles)
 //	GET /tile/entries/<NNN..>  — entry (data) tiles (c2sp tlog-tiles)
+//	GET /config                — redacted config JSON (only if WithConfigJSON)
 //	GET /landmarks             — §6.3.1 landmark list (only if WithLandmarks)
 func (s *Server) Handler() http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /{$}", s.handleIndex)
 	mux.HandleFunc("GET /app.js", s.handleAppJS)
 	mux.HandleFunc("GET /checkpoint", s.handleCheckpoint)
 	mux.HandleFunc("GET /tile/", s.handleTile)
+	if s.configJSON != nil {
+		mux.HandleFunc("GET /config", s.handleConfig)
+	}
 	if s.landmarks != nil {
 		mux.Handle("GET /landmarks", s.landmarks.Handler())
 		mux.Handle("HEAD /landmarks", s.landmarks.Handler())
@@ -93,6 +108,12 @@ func (s *Server) handleCheckpoint(w http.ResponseWriter, r *http.Request) {
 	w.Write(cp.SignedNote)
 }
 
+func (s *Server) handleConfig(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-cache, max-age=0")
+	w.Write(s.configJSON)
+}
+
 func (s *Server) handleTile(w http.ResponseWriter, r *http.Request) {
 	// Path format (c2sp tlog-tiles): /tile/<L>/NNN[.p/W] for hash tiles,
 	// /tile/entries/NNN[.p/W] for entry (data) tiles.