A pure Perl keyserver! When it receives a key, it does stuff to it then sticks it in postgres database.
- 'Secret' upload path.
- Disable upload for secret, normal path, or both. For when you don't want people to upload keys.
- Perl v5.38.0 or greater
- Relevant Mojo/Mojolicious modules and other Perl modules
- Postgresql server
- A dedicated user would be nice
- This does not yet offer a way for a user to delete their keys. In countries that respect the GDPR, this is bad.
- This isn't a completed project yet.
Maybe it is packaged by your distro maintainers?
- Debian
apt install libmojolicious-perl libmojo-pg-perl
Note: the latest Perl at the time of writing on Debian stable is v5.36.x which doesn't have class support... I really wanted to use class(). Sorry! So, right now, you're likely better off installing perlbrew and having the dedicated user that will run this program compile and install perl v5.38.x or higher.
sudo adduser --group --home /var/lib/mikukeyserver --system -- mikukeyserver
sudo useradd --system --create-home --home-dir /var/lib/mikukeyserver --shell /bin/nologin mikukeyserver
Probably not needed info, but postgres here is version 15.
% sudo apt install postgresql postgresql-server-dev-xx
% sudo -u postgres psql # test if 'active' so to speak.
Follow instructions from 'Create relevant details for the database.'
% sudo apt install perlbrew
% sudo -u mikukeyserver perlbrew init
% echo 'source ~/perl5/perlbrew/etc/bashrc' | sudo -u mikukeyserver tee -a /var/mikukeyserver/.profile
% sudo -u mikukeyserver perlbrew available # pick at least v5.38.x. Here I pick 5.40.x
% sudo -u mikukeyserver perlbrew install perl-5.40.0 # this *will* take a while
% sudo -u mikukeyserver perlbrew install-cpanm
% sudo chsh mikukeyserver -s /bin/bash # we will set this back to /bin/nologin later
% sudo -u mikukeyserver -i
mikukeyserver% perlbrew switch perl-5.40.0
mikukeyserver% PERL_CPANM_HOME=/tmp cpanm DBD::Pg # needs postgresql-server-dev-xx (on debian)
mikukeyserver% cpanm Mojolicious Mojo::Pg # AND postgres itself must be running
# DBD::Pg test wants to poke stuff, fails otherwise
mikukeyserver% perl ./keyserver # see whats broken or not.
# after you've made sure it works...
mikukeyserver% exit
% sudo chsh mikukeyserver -s /bin/nologin
cpanm Mojolicious Mojo::Pg
Installing via cpan(m) will work because the Mojolicious devs are competent (to be more specific, they opt to recreate everything, that way if a dependency breaks because the author is ignoring issues or has passed on there won't be permanently broken cpan repos that mojolicious depends on)
cp keyserver.conf.example keyserver.conf
vim keyserver.conf
chmod 600 keyserver.conf # this file has secrets
An example that you may follow:
sudo -u postgres psql
postgres=# create database mikukeyserverdb;
postgres=# create user mikukeyserver with encrypted password 'WorldisMine';
postgres=# grant all privileges on database mikukeyserverdb to mikukeyserver;
postgres=# \c mikukeyserverdb;
mikukeyserverdb=# grant all privileges on schema public to mikukeyserver;
mikukeyserverdb=# exit
For some reason, hypnotoad (or morbo) lacks a 'config' flag and there isn't a way to set it as far as I can tell (even in program (for now)). What I do know is that it looks for keyserver.conf somewhere, most likely working directory, but maybe the directory the program itself is in.
I used use lib qw(lib) in my program, which means the working directory has have 'lib/KeyData.pm' in it, or be manually installed somewhere (really not recommended). Basically the directory keyserver program resides in.
I will add a dedicated installer for this, later. KeyData.pm is useful.
sudo -u mikukeyserver hypnotoad -f ./keyserver; # -f = starts in foreground
It's a good idea to proxy this program behind another dedicated program that listens on relevant ports: no TLS, 11371 and 80; with TLS, 11372 and 443.
gpg --keyserver hkp(s)://hostname --send-keys <keyid>
gpg --keyserver hkp(s)://hostname --search-keys <search string>
gpg --keyserver hkp(s)://hostname --recv-keys <keyid>
http(s)://hostname
Make sure the service file actually makes sense for your use case; unless you've followed the guide in this README, it most certainly does not.
vim mikukeyserver.service
sudo cp mikukeyserver.service /etc/systemd/system
sudo systemctl daemon-reload
sudo systemctl start mikukeyserver.service