Documentation
¶
Overview ¶
Package openbao is the production secrets.Cipher: encryption as a service through an OpenBao (or any Vault-compatible) transit engine, spoken over its plain HTTP API — deliberately not the official client library, whose dependency tree buys nothing for the two calls this needs (docs/plan/12, D1). Ciphertext carries the engine's own "vault:vN:" version prefix, so key rotation on the bao side keeps old rows decryptable with no schema change.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Cipher ¶
type Cipher struct {
// contains filtered or unexported fields
}
Cipher is the transit-backed implementation of secrets.Cipher.
func New ¶
New validates the config eagerly and ensures the named transit key exists — an unreachable bao, a bad token, or an unmounted transit engine must fail at startup, not on the first credential write. Creating an existing key is a server-side no-op, so New is idempotent.
type Config ¶
type Config struct {
Address string // base URL, e.g. http://openbao:8200
Token string
Key string // transit key name; also the keyID stored next to ciphertext
// HTTPClient overrides the default 10s-timeout client (tests).
HTTPClient *http.Client
}
Config locates the transit engine and the named key. Token is sent as X-Vault-Token and never logged or echoed in errors.
Source Files