3.9 KiB
Extension Challenges
Pick one and ship it as a PR.
Beginner
1. Add a fifth rotator: PostgreSQL ALTER USER
A new file src/cre/rotators/postgres_user.cr that rotates a Postgres role's password directly via ALTER USER ... PASSWORD .... Use the existing 4-step contract; verify by opening a fresh connection with the new password. Drop the file in - the macro registers it automatically. Add unit specs in spec/unit/rotators/postgres_user_spec.cr.
2. Slack notifier subscriber
Mirror TelegramSubscriber against Slack's chat.postMessage. Add chat ID allowlist, channel-id parameterization, and message formatting. Single new file in src/cre/notifiers/.
3. Add notify_via :slack to the Channel enum
Once you have a Slack notifier, add Slack to Channel in src/cre/policy/policy.cr, dispatch on it in the evaluator, and write a policy in policies/ that uses it.
Intermediate
4. Web dashboard via SSE
Add src/cre/web/ with a Lucky/Kemal HTTP server that subscribes to the bus and pushes events as Server-Sent Events to an HTMX dashboard. Reuse Tui::State as the data model - it already has the right shape. The point of the bus + plugin architecture is that this is a new subscriber, not a rewrite.
5. ML-KEM hybrid wrap for KEK
Add algorithm_id = 0x03 to envelope encryption: hybrid Curve25519 + ML-KEM-768 (Kyber) for the DEK wrap. Provides forward secrecy against future quantum-attack on captured ciphertexts. Note: ML-KEM is in OpenSSL 3.x; you may need to update LibCrypto FFI bindings.
6. OpenTimestamps anchoring
Anchor each audit_batches Merkle root to the Bitcoin blockchain via OpenTimestamps. Adds a fourth integrity layer: even if the entire DB and signing key are compromised, an offline auditor with a Bitcoin full node can verify when each batch existed. Update src/cre/audit/batch_sealer.cr to publish OTS proofs alongside Ed25519 signatures.
Advanced
7. SPIFFE/SPIRE workload identity rotator
Add a rotator that replaces static credentials with SPIFFE SVIDs (X.509 + JWT). Demonstrates the post-2024 industry shift away from rotation entirely toward attestation-based ephemeral identity. Touch points: new client in src/cre/spiffe/, new rotator in src/cre/rotators/spiffe.cr, new credential kind in src/cre/domain/credential.cr.
8. Crash recovery state machine
Implement the recovery protocol described in the spec: on boot, scan rotations table for non-terminal states; for each, decide whether to rollback, retry, or mark inconsistent. The current orchestrator publishes events but doesn't recover from a daemon crash mid-rotation. Add src/cre/engine/recovery.cr with explicit state-machine semantics for each (rotator_kind, last_step) pair.
9. Multi-tenant support
Wire tenant_id through the schema (already reserved as a column placeholder), the AAD construction, the policy matchers (allow c.tenant == "tenant-x"), and the API surface. Postgres row-level security policies enforce isolation at the DB level. The biggest design decision: per-tenant KEKs vs shared KEK with per-tenant DEKs.
10. JIT credential broker
Replace the rotation contract entirely for some credential types: instead of rotating, issue a fresh ephemeral credential on each access (5-15 minute TTL). Requires a new Broker abstraction alongside Rotator, integration with AWS STS / GCP service account impersonation / Vault dynamic, and consumer-side token refresh logic in the example apps.
Evaluation rubric (for self-review)
A great extension PR:
- Has unit tests in
spec/unit/<area>/mirroring the source layout - Has a focused commit message explaining the why, not just the what
- Doesn't break existing tests (
crystal spec spec/should be green) - Adds 1-3 file-level changes; if it touches more than 5 files, the abstraction is probably wrong
- Surfaces failure modes honestly (e.g., the JIT broker should clearly document the consumer-side complexity it shifts)