Absolute End-to-End Encryption for standard REST APIs

package main

import (
	"github.com/AegisHttp/gofiber-aegis"
	"github.com/gofiber/fiber/v2"
)

func main() {
	app := fiber.New()

	// Inject Aegis Decryption Middleware globally
	app.Use(aegis.New(aegis.Config{
		PrivateKeyRingPath: "/home/server/.gnupg/secring.gpg",
		PrivateKeyPassphrase: "SuperSecretBackendPassphrase",
		KeyserverPublish: true, // Auto publishes server public key to Ubuntu keyservers
	}))

	// Your standard routing works out of the box with decrypted JSON payload
	app.Post("/api/secure-profile", func(c *fiber.Ctx) error {
		type RequestData struct {
			SSN     string  `json:"SSN"`
			Balance float64 `json:"balance"`
		}

		var req RequestData
		if err := c.BodyParser(&req); err != nil {
			return c.Status(400).SendString(err.Error())
		}

		return c.JSON(fiber.Map{
			"status": "success",
			"message": "Secure payload processed",
		})
	})

	app.Listen(":8080")
}

use axum::{routing::post, Json, Router};
use aegis_tokio::DecryptLayer;
use serde::{Deserialize, Serialize};

#[derive(Deserialize)]
struct ProfileRequest {
    ssn: String,
    balance: f64,
}

#[derive(Serialize)]
struct ProfileResponse {
    status: String,
}

async fn handle_profile(Json(payload): Json) -> Json {
    // Process standard decrypted payload safely
    Json(ProfileResponse {
        status: format!("Processed secure profile for SSN length: {}", payload.ssn.len()),
    })
}

#[tokio::main]
async fn main() {
    let app = Router::new()
        .route("/api/secure-profile", post(handle_profile))
        .layer(DecryptLayer::new("/etc/aegis/server_private.key"));

    axum::Server::bind(&"0.0.0.0:8080".parse().unwrap())
        .serve(app.into_make_service())
        .await
        .unwrap();
}

{
    order aegis_http before reverse_proxy
}

:8080 {
    # Route block containing Aegis handler
    route {
        aegis_http {
            challenge_path /api/challenge
            login_path /api/login
            decrypt_requests
            encrypt_responses
            require_keyserver
            check_revocation
            tunneling_enabled
            server_email "api@example.com"
            server_passphrase "secret"
            server_private_key_path "/etc/caddy/server_private.asc"
            server_public_key_path "/etc/caddy/server_public.asc"
        }

        # Seamlessly forwards decrypted traffic to any standard backend
        reverse_proxy localhost:3000
    }
}