Documentation
¶
Overview ¶
Package secrets is the DevHub's encrypted-at-rest secrets store (S47b). Server admin keys live age-encrypted on the DevHub box and are decrypted ONLY into this process' memory:
<dir>/age.key X25519 identity (0600), generated once — never leaves the box
<dir>/secrets.age age-encrypted JSON {"<server_id>": {"admin_key": "..."}}
Invariants: plaintext never touches disk, SQLite, API responses or logs. Every Get for an operation is reported through the Audit callback — the audit records USAGE, never values. Writes re-encrypt the full set and land atomically (tmp + rename, 0600).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AuditFn ¶
type AuditFn func(serverID, operation string)
AuditFn records that a secret was used (serverID + operation, never the value). May be nil.
type Store ¶
type Store struct {
// Audit is invoked on every successful Get. Set it right after Open.
Audit AuditFn
// contains filtered or unexported fields
}
Store holds the decrypted secrets in memory; the encrypted file is the source of truth after every Set/Delete.
func Open ¶
Open loads (or creates, on first run) the age identity at dir/age.key and decrypts dir/secrets.age into memory. A missing secrets file is an empty store, not an error.
func (*Store) Get ¶
Get returns a secret and reports the usage (operation) to the Audit callback. The operation names the caller's intent ('metrics_scrape', ...).
Source Files