Documentation
¶
Overview ¶
Package config loads the user-global config (~/.config/notenv/config.toml, not committed) and merges it with the project contract into an effective configuration. A machine may define several named storages; the storage target is machine-only, and the contract contributes just the namespace.
Index ¶
- Constants
- func CacheScope(remote, base string) string
- func CheckPin(stored Pin, have bool, obsRevision int, obsMasterPub string) (advance bool, err error)
- func Dir() (string, error)
- func Exists() bool
- func IdentityPath() (string, error)
- func MachineID() (string, error)
- func NextSeq(scope, namespace string) (int, error)
- func Path() (string, error)
- func ReadLocalBinding(dir string) (string, error)
- func SetDefault(name string) error
- func UpsertStorage(name string, entry StorageEntry, makeDefault bool) (string, error)
- func ValidStorageName(name string) bool
- func WriteLocalBinding(dir, storageName string) (string, error)
- func WritePin(scope string, p Pin) error
- type Effective
- type Pin
- type StorageEntry
- type User
Constants ¶
const ( DefaultBase = "notenv" DefaultStorage = "default" // name of the storage setup creates first ModePass = "passphrase" DefaultCacheTTL = time.Hour // master-key keyring cache DefaultBlobCacheTTL = time.Hour // local ciphertext cache (matches key cache; --refresh forces fresh) )
const LocalBindingFile = "notenv.local.toml"
LocalBindingFile is the per-checkout, git-ignored file that binds a project to a named storage. It lives beside the contract and is never committed.
Variables ¶
This section is empty.
Functions ¶
func CacheScope ¶
CacheScope is the keyring cache key for a storage base. Length-prefixed on the remote so (remote, base) pairs can't alias: a plain "remote:base" join makes ("r","a:b") and ("r:a","b") collide.
func CheckPin ¶ added in v0.2.0
func CheckPin(stored Pin, have bool, obsRevision int, obsMasterPub string) (advance bool, err error)
CheckPin compares an observed header (revision, master public key) against the stored pin. It returns advance=true when the pin should move forward (or on first contact), or an actionable error on a rollback or unexpected master-change alarm.
func Exists ¶
func Exists() bool
Exists reports whether a user config file is present (the "is this machine set up" check).
func IdentityPath ¶ added in v0.2.0
IdentityPath returns the default age identity file location. It holds the private key a teammate unlocks their recipient slot with; the NOTENV_IDENTITY environment variable overrides it.
func MachineID ¶ added in v0.3.0
MachineID returns this machine's stable identifier, creating it on first use. It names and orders the segments this machine writes, so two machines never produce the same segment. It is random, not secret, and lives in local state.
func NextSeq ¶ added in v0.3.0
NextSeq returns the next strictly-increasing sequence number for (scope, namespace) on this machine, persisting the counter. It orders this machine's segments even when a freshly listed remote is briefly stale, so two of its writes never share a sequence number.
func ReadLocalBinding ¶ added in v0.2.0
ReadLocalBinding returns the storage name bound to the project in dir, or "" when no binding file exists.
func SetDefault ¶ added in v0.2.0
SetDefault changes which storage is the default.
func UpsertStorage ¶ added in v0.2.0
func UpsertStorage(name string, entry StorageEntry, makeDefault bool) (string, error)
UpsertStorage adds or replaces a named storage and writes the config. The storage becomes the default if it is the first one, if no default is set, or if makeDefault is true. Returns the config path.
func ValidStorageName ¶ added in v0.2.0
ValidStorageName reports whether name is usable as a storage name.
func WriteLocalBinding ¶ added in v0.2.0
WriteLocalBinding records the storage a project uses in dir and returns the file path. The caller is responsible for git-ignoring it.
Types ¶
type Effective ¶
type Effective struct {
StorageName string // the resolved storage name
Remote string // rclone remote name
Base string // path within the remote
Versioned bool // remote retains versions on overwrite
Namespace string
Mode string // crypto mode
CacheTTL time.Duration // master-key cache TTL; <= 0 disables caching
BlobCacheTTL time.Duration // local ciphertext cache TTL; <= 0 disables
}
Effective is the merged result of the selected storage + contract.
type Pin ¶ added in v0.2.0
Pin is a per-vault rollback anchor: the highest header revision this machine has seen and the master public key it expects. It is not secret (the threat is storage write, not local read), so it lives in a plain local file.
type StorageEntry ¶ added in v0.2.0
type StorageEntry struct {
Remote string `toml:"remote"`
Base string `toml:"base"`
// Versioned: the remote retains old object versions on overwrite
// (B2 does natively), so skip the ~3s server-side .prev backup copy.
Versioned bool `toml:"versioned"`
// CacheTTL bounds local ciphertext-cache lifetime for this storage
// (Go duration; "0" disables). Default 1h.
CacheTTL string `toml:"cache_ttl"`
}
StorageEntry is one named storage target.
type User ¶
type User struct {
Default string `toml:"default"`
Storage map[string]StorageEntry `toml:"storage"`
Crypto struct {
Mode string `toml:"mode"`
// CacheTTL is how long the master-key cache may hold the key
// (Go duration string; "0" disables caching). Default: 1h.
CacheTTL string `toml:"cache_ttl"`
} `toml:"crypto"`
}
User is the per-machine config. Storage targets are keyed by name so one machine can drive several vaults; Default names the one used when a project has no local binding.
func LoadUser ¶
LoadUser reads the user config. A missing file is not an error: it returns a zero-value config (callers surface the "no storage" error later).
func (*User) MasterCacheTTL ¶ added in v0.2.0
MasterCacheTTL is the master-key cache lifetime (crypto.cache_ttl; default 1h, "0" disables caching).
func (*User) SelectStorage ¶ added in v0.2.0
func (u *User) SelectStorage(explicit string) (string, StorageEntry, error)
SelectStorage picks the storage to use, in precedence order: an explicit name (from --storage or a project's local binding) → the configured default → the sole storage when only one exists. It returns the resolved name and entry, or an actionable error.
func (*User) StorageNames ¶ added in v0.2.0
StorageNames returns the configured storage names, sorted.
Source Files