local

package

v0.5.1 Latest Latest Go to latest Published: Oct 4, 2026 License: Apache-2.0 Imports: 6 Imported by: 0

Documentation ¶

Overview ¶

Package local is the AES-256-GCM secrets.Cipher for tests and minimal deployments: one 32-byte master key from configuration, no external service. Production deployments use internal/secrets/openbao; this backend keeps `make test` and bao-less installs working (docs/plan/12, D1).

Index ¶

type Cipher
- func New(cfg Config) (*Cipher, error)
- func (c *Cipher) Decrypt(_ context.Context, ciphertext []byte, keyID string) ([]byte, error)
- func (c *Cipher) Encrypt(_ context.Context, plaintext []byte) ([]byte, string, error)
type Config

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Cipher ¶

type Cipher struct {
	// contains filtered or unexported fields
}

Cipher is the local AES-256-GCM implementation of secrets.Cipher.

func New ¶

func New(cfg Config) (*Cipher, error)

New validates the config eagerly: a wrong-size key must fail at startup, not on the first credential write.

func (*Cipher) Decrypt ¶

func (c *Cipher) Decrypt(_ context.Context, ciphertext []byte, keyID string) ([]byte, error)

Decrypt reverses Encrypt. A keyID this cipher does not hold, or ciphertext that fails authentication, is an error.

func (*Cipher) Encrypt ¶

func (c *Cipher) Encrypt(_ context.Context, plaintext []byte) ([]byte, string, error)

Encrypt seals plaintext under a fresh random nonce, with the key id as additional authenticated data so a ciphertext cannot be replayed under a different key id. Layout: nonce || sealed.

type Config ¶

type Config struct {
	KeyID string
	Key   []byte // exactly 32 bytes
}

Config carries the master key and the identifier stored next to every ciphertext. A new KeyID with a new Key is how an operator rotates: old rows keep decrypting under the old pair for as long as it stays configured.

Source Files ¶

View all Source files

local.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL