Documentation
¶
Overview ¶
Package secrets stores small dejima-held secrets (webhook HMAC keys and the like) at rest in the OS keychain when one is available — the macOS login Keychain via `security`, or the Secret Service (libsecret) via `secret-tool` on Linux — and falls back to a 0600 file under ~/.dejima/secrets otherwise.
The fallback is deliberate, not a failure mode: a `--system` daemon starts at boot *before any login*, when the login keychain is still locked, so a keychain write/read can fail until someone logs in once. Rather than hard-fail (the trap the roadmap calls out — reporting "never configured" when the keychain is merely locked), every operation degrades to the file store. So a secret set while the keychain was locked lands in the file and is still readable; secrets set while unlocked live in the keychain.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store reads/writes secrets, preferring the OS keychain and falling back to a file. It's safe for concurrent use.
func Open ¶
Open builds a Store: the platform keychain backend if its CLI is on PATH, plus the always-available file fallback.
func (*Store) Backend ¶
Backend names the active keychain backend ("macos-keychain", "secret-service", or "file" when no keychain is usable) — for diagnostics.
Source Files