sops/keyservice/keyservice.proto

syntax = "proto3";

option go_package = "./keyservice";

message Key {
	oneof key_type {
		KmsKey kms_key = 1;
		PgpKey pgp_key = 2;
		GcpKmsKey gcp_kms_key = 3;
		AzureKeyVaultKey azure_keyvault_key = 4;
		VaultKey vault_key = 5;
		AgeKey age_key = 6;
	}
}

message PgpKey {
	string fingerprint = 1;
}

message KmsKey {
	string arn = 1;
	string role = 2;
	map<string, string> context = 3;
	string aws_profile = 4;
}

message GcpKmsKey {
	string resource_id = 1;
}

message VaultKey {
	string vault_address = 1;
	string engine_path = 2;
	string key_name = 3;
}

message AzureKeyVaultKey {
	string vault_url = 1;
	string name = 2;
	string version = 3;
}

message AgeKey {
	string recipient = 1;
}

message EncryptRequest {
	Key key = 1;
	bytes plaintext = 2;
}

message EncryptResponse {
	bytes ciphertext = 1;
}

message DecryptRequest {
	Key key = 1;
	bytes ciphertext = 2;
}

message DecryptResponse {
	bytes plaintext = 1;
}

service KeyService {
	rpc Encrypt (EncryptRequest) returns (EncryptResponse) {}
	rpc Decrypt (DecryptRequest) returns (DecryptResponse) {}
}