Ship production deployment and runtime observability

crates/remora-credentials/src/vault.rs

@@ -53,7 +53,7 @@ impl fmt::Debug for VaultConfig {
 impl VaultConfig {
     pub fn from_env() -> Result<Self, CredentialError> {
         let address = required_env("REMORA_VAULT_ADDR")?;
-        let token = required_env("REMORA_VAULT_TOKEN")?;
+        let token = vault_token()?;
         let full_path = required_env("REMORA_VAULT_PATH")?;
         let (mount, path_prefix) = split_vault_path(&full_path)?;
         Ok(Self {
@@ -95,6 +95,21 @@ impl VaultConfig {
     }
 }
 
+fn vault_token() -> Result<String, CredentialError> {
+    if let Ok(token) = required_env("REMORA_VAULT_TOKEN") {
+        return Ok(token);
+    }
+    let path = required_env("REMORA_VAULT_TOKEN_FILE")?;
+    let token = std::fs::read_to_string(path).map_err(|error| {
+        CredentialError::Config(format!("cannot read Vault token: {}", error.kind()))
+    })?;
+    let token = token.trim().to_owned();
+    if token.is_empty() {
+        return Err(CredentialError::Config("Vault token file is empty".into()));
+    }
+    Ok(token)
+}
+
 #[derive(Clone)]
 pub struct VaultClient {
     http: Client,
@@ -131,6 +146,21 @@ impl VaultClient {
         &self.config
     }
 
+    pub async fn check(&self) -> Result<(), CredentialError> {
+        let url = format!(
+            "{}/v1/sys/health?standbyok=true&perfstandbyok=true",
+            self.config.address.trim_end_matches('/')
+        );
+        let response = self.http.get(url).send().await.map_err(map_transport)?;
+        let status = response.status();
+        let _ = response.bytes().await;
+        if status.is_success() {
+            Ok(())
+        } else {
+            Err(map_http_status(status, "check vault health"))
+        }
+    }
+
     /// Create secret material and return the immutable KV v2 version number.
     ///
     /// The write uses CAS 0 so an existing intent-bound path is never overwritten.