feat: enhance Ed25519 private key parsing to support PKCS#8 format

Signed-off-by: Noste <83548733+Noooste@users.noreply.github.com>

backend/internal/auth/jwt.go

@@ -3,6 +3,7 @@ package auth
 import (
 	"crypto/ed25519"
 	"crypto/rand"
+	"crypto/x509"
 	"encoding/base64"
 	"encoding/pem"
 	"fmt"
@@ -76,12 +77,22 @@ func parseEd25519PrivateKeyFromPEM(privateKeyPEM string) (ed25519.PrivateKey, er
 		return nil, fmt.Errorf("failed to decode PEM block")
 	}
 
-	// Check if it's raw Ed25519 private key bytes (64 bytes)
-	if len(block.Bytes) == ed25519.PrivateKeySize {
-		return ed25519.PrivateKey(block.Bytes), nil
+	// Try to parse as PKCS#8 format (standard format from openssl genpkey -algorithm ED25519)
+	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err == nil {
+		// Successfully parsed as PKCS#8, check if it's an Ed25519 key
+		if ed25519Key, ok := key.(ed25519.PrivateKey); ok {
+			return ed25519Key, nil
+		}
+		return nil, fmt.Errorf("PKCS#8 key is not an Ed25519 key")
 	}
 
-	return nil, fmt.Errorf("invalid Ed25519 private key format: expected %d bytes, got %d",
+	// Fallback: Check if it's raw Ed25519 private key bytes (64 bytes)
+	if len(block.Bytes) == ed25519.PrivateKeySize {
+		return block.Bytes, nil
+	}
+
+	return nil, fmt.Errorf("invalid Ed25519 private key format: not PKCS#8 and not raw %d bytes (got %d bytes)",
 		ed25519.PrivateKeySize, len(block.Bytes))
 }
 

helm/garage-ui/Chart.yaml

@@ -3,7 +3,7 @@ name: garage-ui
 description: A Helm chart for Garage UI - Web interface for Garage S3 object storage
 icon: https://helm.noste.dev/garage.png
 type: application
-version: 0.1.10
+version: 0.1.11
 appVersion: "v0.1.0"
 keywords:
   - garage

helm/garage-ui/README.md

@@ -2,7 +2,7 @@
 
 A Helm chart for deploying [Garage UI](https://github.com/Noooste/garage-ui), a modern web interface for managing [Garage](https://garagehq.deuxfleurs.fr/) distributed object storage systems.
 
-[![Version](https://img.shields.io/badge/version-0.1.10-blue.svg)](Chart.yaml)
+[![Version](https://img.shields.io/badge/version-0.1.11-blue.svg)](Chart.yaml)
 [![App Version](https://img.shields.io/badge/app%20version-v0.1.0-green.svg)](Chart.yaml)
 
 ## Table of Contents

helm/garage-ui/templates/jwt.yaml

@@ -1,105 +0,0 @@
-{{- if not .Values.config.auth.jwt_private_key_secret.name }}
-{{- $secretName := printf "%s-jwt-key" (include "garage-ui.fullname" .) }}
-{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $secretName }}
-{{- if not $existingSecret }}
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-  labels:
-    {{- include "garage-ui.labels" . | nindent 4 }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade
-    "helm.sh/hook-weight": "-5"
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-spec:
-  template:
-    metadata:
-      name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-    spec:
-      restartPolicy: Never
-      serviceAccountName: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-      containers:
-      - name: jwt-key-generator
-        image: alpine:3.18
-        command:
-        - /bin/sh
-        - -c
-        - |
-          set -e
-
-          # Install openssl
-          apk add --no-cache openssl kubectl
-
-          # Generate Ed25519 private key
-          openssl genpkey -algorithm ED25519 -out /tmp/jwt-key.pem
-
-          # Create Kubernetes secret
-          kubectl create secret generic {{ $secretName }} \
-            --from-file=jwt-key.pem=/tmp/jwt-key.pem \
-            --namespace={{ .Release.Namespace }} \
-            --dry-run=client -o yaml | kubectl apply -f -
-
-          # Add labels to the secret
-          kubectl label secret {{ $secretName }} \
-            --namespace={{ .Release.Namespace }} \
-            helm.sh/chart={{ include "garage-ui.chart" . }} \
-            {{ include "garage-ui.selectorLabels" . | replace ": " "=" | replace "\n" " " }} \
-            app.kubernetes.io/version={{ .Chart.AppVersion | quote }} \
-            app.kubernetes.io/managed-by={{ .Release.Service }} \
-            --overwrite
-
-          # Add annotation to keep the secret
-          kubectl annotate secret {{ $secretName }} \
-            --namespace={{ .Release.Namespace }} \
-            "helm.sh/resource-policy=keep" \
-            --overwrite
-
-          echo "JWT private key generated and stored in secret: {{ $secretName }}"
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-  labels:
-    {{- include "garage-ui.labels" . | nindent 4 }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade
-    "helm.sh/hook-weight": "-10"
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-  labels:
-    {{- include "garage-ui.labels" . | nindent 4 }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade
-    "helm.sh/hook-weight": "-10"
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "create", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-  labels:
-    {{- include "garage-ui.labels" . | nindent 4 }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade
-    "helm.sh/hook-weight": "-10"
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-subjects:
-- kind: ServiceAccount
-  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
-  namespace: {{ .Release.Namespace }}
-{{- end }}
-{{- end }}

helm/garage-ui/templates/secret.yaml

@@ -51,3 +51,22 @@ type: Opaque
 data:
   jwt-key.pem: {{ .Values.config.auth.jwt_private_key | b64enc | quote }}
 {{- end }}
+---
+{{- if not .Values.config.auth.jwt_private_key_secret.name }}
+{{- $secretName := printf "%s-jwt-key" (include "garage-ui.fullname" .) }}
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $secretName }}
+{{- if not $existingSecret }}
+{{- $privateKey := genPrivateKey "ed25519" }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  labels:
+    {{- include "garage-ui.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
+type: Opaque
+data:
+  jwt-key.pem: {{ $privateKey | b64enc | quote }}
+{{- end }}
+{{- end }}