|
| 1 | +<?php |
| 2 | + |
| 3 | + # prevent direct access |
| 4 | + if (!defined("SYS11_SECRETS")) { die(""); } |
| 5 | + |
| 6 | + function env($name, $default = null) { |
| 7 | + $result = getenv($name); |
| 8 | + |
| 9 | + # set the default if the environment variable isn't set |
| 10 | + if (false === $result) { |
| 11 | + $result = $default; |
| 12 | + } |
| 13 | + |
| 14 | + return $result; |
| 15 | + } |
| 16 | + |
| 17 | + function checkbool($string) { |
| 18 | + return filter_var($string, FILTER_VALIDATE_BOOLEAN); |
| 19 | + } |
| 20 | + |
| 21 | + function load_dot_env($filename) { |
| 22 | + # read the .env file |
| 23 | + $dotenv = parse_ini_file($filename); |
| 24 | + if (false !== $dotenv) { |
| 25 | + foreach ($dotenv as $key => $value) { |
| 26 | + # only set environment variables that are not already set |
| 27 | + if (false === getenv($key)) { |
| 28 | + putenv($key."=".$value); |
| 29 | + } |
| 30 | + } |
| 31 | + } |
| 32 | + } |
| 33 | + |
| 34 | + function split_rsa_keys($string) { |
| 35 | + $result = []; |
| 36 | + |
| 37 | + if (false !== preg_match_all("@(?<rsakeys>-----BEGIN (?:RSA )?(?:PRIVATE|PUBLIC) KEY-----(?:.+?)-----END (?:RSA )?(?:PRIVATE|PUBLIC) KEY-----)@is", |
| 38 | + $string, $matches)) { |
| 39 | + if (array_key_exists("rsakeys", $matches)) { |
| 40 | + # cleanup strings |
| 41 | + foreach ($matches["rsakeys"] as $match_key => $match_value) { |
| 42 | + $lines = explode("\n", $match_value); |
| 43 | + foreach ($lines as $line_key => $line_value) { |
| 44 | + $lines[$line_key] = trim($line_value); |
| 45 | + } |
| 46 | + $matches["rsakeys"][$match_key] = implode("\n", $lines); |
| 47 | + } |
| 48 | + |
| 49 | + $result = $matches["rsakeys"]; |
| 50 | + } |
| 51 | + } |
| 52 | + |
| 53 | + return $result; |
| 54 | + } |
| 55 | + |
| 56 | + # load a .env file if it exists |
| 57 | + if (is_file(ROOT_DIR."/.env")) { |
| 58 | + load_dot_env(ROOT_DIR."/.env"); |
| 59 | + } |
| 60 | + |
| 61 | + # this is an array containing the supported RSA privated keys for encryption and decryption, the LAST RSA private key |
| 62 | + # within the array is used to encrypt new secrets while all RSA private keys are used to decrypt secrets, this allows |
| 63 | + # for smooth key rollovers; for share-only instances it is sufficient to set the RSA public key of the corresponding |
| 64 | + # read-only instance here |
| 65 | + define("RSA_PRIVATE_KEYS", split_rsa_keys(env("RSA_PRIVATE_KEYS", null))); |
| 66 | + |
| 67 | + # this is the title of the service, it is shown in header of all pages |
| 68 | + define("SERVICE_TITLE", env("SERVICE_TITLE", "Shared-Secrets")); |
| 69 | + |
| 70 | + # this is the full path to the secret sharing service, the encrypted secret will be appended to this string |
| 71 | + define("SECRET_SHARING_URL", env("SECRET_SHARING_URL", "https://localhost.local/")); |
| 72 | + |
| 73 | + # this is the text of the imprint link |
| 74 | + define("IMPRINT_TEXT", env("IMPRINT_TEXT", null)); |
| 75 | + |
| 76 | + # this is the URL the imprint link shall forward to |
| 77 | + define("IMPRINT_URL", env("IMPRINT_URL", "https://localhost.local/")); |
| 78 | + |
| 79 | + # this is the MySQL configuration, do not forget to create the corresponding database and the following table: |
| 80 | + # > CREATE TABLE secrets ( keyid VARCHAR(64), fingerprint VARCHAR(64), time TIMESTAMP, PRIMARY KEY (keyid, fingerprint) ); |
| 81 | + define("MYSQL_HOST", env("MYSQL_HOST", "localhost")); |
| 82 | + define("MYSQL_PORT", intval(env("MYSQL_PORT", 3306))); |
| 83 | + define("MYSQL_USER", env("MYSQL_USER", null)); |
| 84 | + define("MYSQL_PASS", env("MYSQL_PASS", null)); |
| 85 | + define("MYSQL_DB", env("MYSQL_DB", null)); |
| 86 | + |
| 87 | + # this enables or disables the debug mode of the instance |
| 88 | + define("DEBUG_MODE", checkbool(env("DEBUG_MODE", false))); |
| 89 | + |
| 90 | + # this is the default timezone for the execution of the script |
| 91 | + define("DEFAULT_TIMEZONE", env("DEFAULT_TIMEZONE", "Europe/Berlin")); |
| 92 | + |
| 93 | + # this enables or disables the read-only mode of the instance, |
| 94 | + # by using the read-only mode you need another instance to create secret sharing links, |
| 95 | + # this separation can be useful if you only want to be internally able to create links |
| 96 | + define("READ_ONLY", checkbool(env("READ_ONLY", false))); |
| 97 | + |
| 98 | + # this enables or disables the share-only mode of the instance, |
| 99 | + # by using the share-only mode you need another instance to read secret sharing links, |
| 100 | + # this separation can be useful if you only want to be internally able to create links |
| 101 | + define("SHARE_ONLY", checkbool(env("SHARE_ONLY", false))); |
| 102 | + |
| 103 | + # this enables or disables the jumbo secret support, |
| 104 | + # jumbo secrets can be up to 16384 bytes (16kb) in size, |
| 105 | + # jumbo secret sharing links that exceed 2048 bytes (2k) in size will most likely be incompatible with older Internet Explorer versions |
| 106 | + define("JUMBO_SECRETS", checkbool(env("JUMBO_SECRETS", false))); |
| 107 | + |
0 commit comments