Merge pull request #154 from maschwenk/patch-1

Allow PEM contents as Base64 encoded string

Author: evanphx

README.md

@@ -53,6 +53,10 @@ Vault.configure do |config|
   # Custom SSL PEM, also read as ENV["VAULT_SSL_CERT"]
   config.ssl_pem_file = "/path/on/disk.pem"
 
+  # As an alternative to a pem file, you can provide the raw PEM string, also read in the following order of preference:
+  # ENV["VAULT_SSL_PEM_CONTENTS_BASE64"] then ENV["VAULT_SSL_PEM_CONTENTS"]
+  config.ssl_pem_contents = "-----BEGIN ENCRYPTED..."
+
   # Use SSL verification, also read as ENV["VAULT_SSL_VERIFY"]
   config.ssl_verify = false
 

lib/vault/defaults.rb

@@ -1,4 +1,5 @@
 require "pathname"
+require "base64"
 
 module Vault
   module Defaults
@@ -126,7 +127,11 @@ def ssl_ciphers
       # the value for {#ssl_pem_file}, if set.
       # @return [String, nil]
       def ssl_pem_contents
-        ENV["VAULT_SSL_PEM_CONTENTS"]
+        if ENV["VAULT_SSL_PEM_CONTENTS_BASE64"]
+          Base64.decode64(ENV["VAULT_SSL_PEM_CONTENTS_BASE64"])
+        else
+          ENV["VAULT_SSL_PEM_CONTENTS"]
+        end
       end
 
       # The path to a pem on disk to use with custom SSL verification

spec/unit/defaults_spec.rb

@@ -128,11 +128,24 @@ module Vault
     end
 
     describe ".ssl_pem_contents" do
-      it "defaults to ENV['VAULT_SSL_PEM_CONTENTS']" do
+      it "defaults to ENV['VAULT_SSL_PEM_CONTENTS_BASE64']" do
+        with_stubbed_env("VAULT_SSL_PEM_CONTENTS_BASE64" => "YWJjZC0xMjM0\n") do
+          expect(Defaults.ssl_pem_contents).to eq("abcd-1234")
+        end
+      end
+
+      it "falls back to ENV['VAULT_SSL_PEM_CONTENTS']" do
         with_stubbed_env("VAULT_SSL_PEM_CONTENTS" => "abcd-1234") do
           expect(Defaults.ssl_pem_contents).to eq("abcd-1234")
         end
       end
+
+      it "returns nil if neither ENV['VAULT_SSL_PEM_CONTENTS'] \
+          nor ENV['VAULT_SSL_PEM_CONTENTS_BASE64'] are present" do
+        with_stubbed_env("VAULT_SSL_PEM_CONTENTS" => nil, "VAULT_SSL_PEM_CONTENTS_BASE64" => nil) do
+          expect(Defaults.ssl_pem_contents).to eq(nil)
+        end
+      end
     end
 
     describe ".ssl_pem_file" do