Become an upstream provider for fnox

[sandstrom]

@maxtaco would you consider making foks an upstream provider for fnox? (I'm not affiliated)

https://github.com/jdx/fnox

Fnox already supports Vault, param store, etc. Maybe it could support Foks too?

It would (a) give you distribution, fnox is more well known than Foks, (b) would improve tooling, since fnox is more mature, (c) would make it easier to partially adopt Foks, e.g. foks for development secrets, param-store for production secrets, and (d) would play to relative strengths, where foks is advanced crypto, but fnox have great CLI interface and adaptability.

[kg4zow]

I had never heard of fnox, but looking at its source code, it looks like this could (and probably should) be done by "teaching" fnox how to use FOKS as an upstream. It already supports half a dozen other "upstreams", so adding FOKS support shouldn't be too difficult - especially if you know how to program in Rust (which I can sorta read, but have never needed to write).

I've been using pass for ten-plus years, to store passwords needed by scripts (and at first, to store all of my passwords, until 1Password came along). It supports a plugin architecture. One of the ideas floating around in the back of my mind is to write a pass plugin to make it use FOKS as the back-end storage.

At this point I've cobbled together a stand-alone shell script to make sure the idea itself is sound. It uses KV storage with the items under a certain "directory" in the KV namespace, for now the default is /test/pass but the real script would use /app/pass instead. If you're curious, you can see it here. It's not the prettiest script I've ever written, but it seems to work as expected on my machine.

[maxtaco]

Sure, I'd be happy to give this a shot. Is there a developer guide on how to add a new backend, or is it the obvious path, just to put up a PR?

[sandstrom]

I would probably just email JDX or contact him via his website: https://jdx.dev/contact/

I think he's pretty approachable.

You can link to this issue for background if you want, or just copy the argument from above 😄

I'm not affiliated with fnox, it's just that I've looked at both your project and his for developer secrets (and maybe later prod secrets too). Yours seem more compelling from a crypto-standpoint, but his has better developer UX.

So I thought maybe it would benefit both projects to join up (you get exposure, fnox gets a provider with nice crypto).

[maxtaco]

@sandstrom Sent a request, I'll let you know of any updates!

[maxtaco]

Have not heard much back. But I did notice JDX is pretty busy these days having recently announced full time work on mise. Maybe it's worthwhile to put a PR for a change to fnox, can try to work on that soon. Though admittedly my rust is very rusty and I've done very little with it.

[sandstrom]

Sounds like a good idea! 💯

There are already other providers, so there are good examples to look at, and presumably Fnox should want more providers.