s3dotenv initial implementation.

LICENSE

@@ -0,0 +1,7 @@
+Copyright 2017 Culture Amp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -0,0 +1,62 @@
+s3dotenv
+========
+
+`s3dotenv` wraps a program with extra environment variables that it downloads from an S3 object specified by the `S3DOTENV` environment variable. This makes it a useful container `ENTRYPOINT` for environments like [Amazon ECS][ecs] where support for configuration is quite poor. If `S3DOTENV` isn't set, `s3dotenv` gets out of the way, just executing the program.
+
+Some global configuration:
+
+```sh
+export AWS_REGION="us-west-2"
+export S3DOTENV="s3://your-bucket/path/to/file.env"
+```
+
+Create a env file in S3 (you'll need to create the bucket, permissions etc first):
+
+```sh
+echo "EXAMPLE_FOO=remote" | aws s3 cp --sse=aws:kms - "$S3DOTENV"
+```
+
+Run a program (in this case `/usr/bin/env`) with the additional environment:
+
+```sh
+EXAMPLE_BAR=local s3dotenv env | grep EXAMPLE
+
+# 2017/08/02 17:43:12 loading env from s3://your-bucket/path/to/file.env
+# EXAMPLE_BAR=local
+# EXAMPLE_FOO=remote
+```
+
+Use it as a `Dockerfile` `ENTRYPOINT`:
+
+```Dockerfile
+COPY s3dotenv /usr/local/bin/s3dotenv
+ENTRYPOINT ["/usr/local/bin/s3dotenv"]
+```
+
+Or as a `Dockerfile` `CMD` wrapper:
+
+```Dockerfile
+COPY s3dotenv /usr/local/bin/s3dotenv
+CMD ["/usr/local/bin/s3dotenv", "your-existing-cmd", "and", "args"]
+```
+
+AWS credentials are discovered in the usual way by the [AWS SDK for Go][aws-sdk]. On AWS, instance/task IAM roles should be used. For local environments, consider [`aws-vault`][aws-vault].
+
+Local environment variables take precedence over those in the env file; if an environment variable exists locally (even if it's blank) the value in the env file will be ignored.
+
+The env file is parsed by [joho/godotenv][godotenv] (a Go port of [bkeepers/dotenv][dotenv]); here's an example:
+
+```
+# This is a comment
+ACME_API_TOKEN=abc123
+PASSWORD='pas$word'
+PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\nHkVN9…\n-----END DSA PRIVATE KEY-----\n"
+SECRET_HASH="something-with-a-#-hash"
+SECRET_KEY=YOURSECRETKEYGOESHERE # inline comment
+```
+
+[aws-vault]: https://github.com/99designs/aws-vault
+[godotenv]: https://github.com/joho/godotenv
+[aws-sdk]: https://aws.amazon.com/sdk-for-go/
+[dotenv]: https://github.com/bkeepers/dotenv
+[ecs]: https://aws.amazon.com/ecs/

main.go

@@ -0,0 +1,119 @@
+package main
+
+import (
+	"io"
+	"io/ioutil"
+	"log"
+	"net/url"
+	"os"
+	"os/exec"
+	"syscall"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/joho/godotenv"
+	"github.com/pkg/errors"
+)
+
+func main() {
+	log.SetOutput(os.Stderr)
+	envExec := os.Environ()
+
+	if u := os.Getenv("S3DOTENV"); u != "" {
+		var err error
+		log.Println("loading env from", u)
+		envExec, err = appendFromS3(envExec, u)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+
+	program, args, err := programAndArgs(os.Args)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	execErr := syscall.Exec(program, args, envExec)
+	if execErr != nil {
+		log.Fatal(errors.Wrap(execErr, "exec "+program))
+	}
+}
+
+func programAndArgs(argv []string) (string, []string, error) {
+	argc := len(argv)
+	if argc == 0 {
+		panic("missing os.Args[0]")
+	} else if argc == 1 {
+		return "", nil, errors.New(argv[0] + " expected program as first argument")
+	}
+	program, err := exec.LookPath(argv[1])
+	if err != nil {
+		return "", nil, errors.Wrap(err, "searching PATH")
+	}
+	var args []string
+	if argc >= 2 {
+		args = argv[1:argc]
+	}
+	return program, args, nil
+}
+
+func appendFromS3(env []string, s3url string) ([]string, error) {
+	// validate S3DOTENV URL
+	u, err := url.Parse(s3url)
+	if err != nil || u.Scheme != "s3" {
+		return nil, errors.New("S3DOTENV expects s3://... env file URL")
+	}
+
+	// read env file using https://github.com/joho/godotenv
+	s3env, err := readEnvFromS3(u)
+	if err != nil {
+		return nil, err
+	}
+
+	// add vars without overwriting existing ones
+	for k, v := range s3env {
+		if _, present := os.LookupEnv(k); present == false {
+			env = append(env, k+"="+v)
+		}
+	}
+
+	return env, nil
+}
+
+func readEnvFromS3(u *url.URL) (map[string]string, error) {
+	tmpfile, err := ioutil.TempFile("", "s3dotenv")
+	if err != nil {
+		return nil, errors.Wrap(err, "create temp file")
+	}
+	defer os.Remove(tmpfile.Name())
+	err = downloadFromS3(tmpfile, u)
+	if err != nil {
+		return nil, errors.Wrap(err, "download from S3")
+	}
+	return godotenv.Read(tmpfile.Name())
+}
+
+func downloadFromS3(file *os.File, u *url.URL) error {
+	bucket := u.Host
+	key := u.Path[1:len(u.Path)]
+	sess := session.Must(session.NewSession())
+	svc := s3.New(sess)
+	s3response, err := svc.GetObject(&s3.GetObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
+	})
+	if err != nil {
+		return errors.Wrap(err, "S3 GetObject")
+	}
+	io.Copy(file, s3response.Body)
+	err = file.Close()
+	if err != nil {
+		return errors.Wrap(err, "close file")
+	}
+	err = s3response.Body.Close()
+	if err != nil {
+		return errors.Wrap(err, "close S3 response")
+	}
+	return nil
+}