tCMS/www/templates/html/components/secrets.tx

<div id="backoffice">
    <h2>Stored Secrets</h2>
    <p>
        Passwords that are not tCMS's, which tCMS needs in order to do something
        on your behalf &mdash; the passphrase to the provisioner's secrets
        database, to begin with.  Store one here and the next thing that needs
        it asks you for a TOTP code instead, which is a thing you have on you
        rather than a thing you have written down.
    </p>

    : if ( !$has_vault ) {
    <p class="guest-reprovision-warning">
        This installation has no vault key, so there is nowhere to keep a secret
        and nothing below will save.  See <code>Trog::Vault</code>: the key is
        handed to the service by systemd, and without one the things that would
        have used a stored secret go on asking for the password directly.
    </p>
    : }

    : if ( $secrets ) {
    <table class="cooltext" style="width:100%;border-collapse:collapse;">
        <thead>
            <tr style="text-align:left;">
                <th style="padding:4px 8px;">Name</th>
                <th style="padding:4px 8px;">Stored</th>
                <th style="padding:4px 8px;">Last used</th>
                <th style="padding:4px 8px;"></th>
            </tr>
        </thead>
        <tbody>
            : for $secrets -> $secret {
            <tr>
                <td style="padding:4px 8px;font-family:monospace;"><: $secret.name :></td>
                <td style="padding:4px 8px;white-space:nowrap;"><: $secret.stored :></td>
                <td style="padding:4px 8px;white-space:nowrap;"><: $secret.used :></td>
                <td style="padding:4px 8px;">
                    : # A row sealed under a key this installation no longer has
                    : # is not going to open, and saying so beats letting somebody
                    : # find out at the moment they were relying on it.
                    : if ( !$secret.readable ) {
                    <span class="tag guest-state" title="this will not open: it was sealed with a vault key this installation no longer has.  Store it again.">unreadable</span>
                    : }
                    <form method="POST" action="/secrets/forget" style="display:inline;">
                        <input type="hidden" name="name" value="<: $secret.name :>" />
                        <button class="coolbutton guest-destroy" type="submit">Forget</button>
                    </form>
                </td>
            </tr>
            : }
        </tbody>
    </table>
    : } else {
    <p>Nothing stored.</p>
    : }

    : # No key, no form.  Everything it could submit would be refused, and a form
    : # that cannot work is worse than no form: it reads as something that ought
    : # to have worked.
    : if ( $has_vault ) {
    <br />
    <h3>Store one</h3>
    <p>
        Storing under a name that is already here replaces it.  Nothing on this
        page ever shows a value back to you &mdash; if you have forgotten one,
        replace it.
    </p>
    <form method="POST" action="/secrets/save">
        <label>
            Name
            <input required class="cooltext" type="text" name="name" pattern="[A-Za-z0-9][A-Za-z0-9._-]*" maxlength="64"
                   placeholder="provisioner"
                   title="letters, digits, dot, dash and underscore.  'provisioner' is the one reprovisioning looks for." />
        </label>
        <label>
            Secret
            <input required class="cooltext" type="password" name="secret" autocomplete="off" />
        </label>
        <input class="coolbutton" type="submit" value="Store it" />
    </form>
    : }
</div>