Documentation
¶
Overview ¶
Package secret provides AES-256-GCM encrypted project secrets management. Secrets are stored in .cloop/secrets.enc and protected by the hub's root key, CLOOP_SECRET_KEY, resolved by pkg/rootkey from a key file, a systemd credential or the environment. During a change of root the file opens under the previous root as well, and every save seals it under the current one.
Index ¶
- Constants
- type Store
- func (s *Store) Delete(key string) bool
- func (s *Store) EnvLines() []string
- func (s *Store) Get(key string) (string, bool)
- func (s *Store) InjectIntoPrompt(prompt string) string
- func (s *Store) Keys() []string
- func (s *Store) Len() int
- func (s *Store) Save() error
- func (s *Store) Set(key, value string)
Constants ¶
const ( // EnvPassphraseKey is the environment variable that holds the passphrase: // one of the sources pkg/rootkey resolves it from. EnvPassphraseKey = rootkey.EnvKey )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store holds the decrypted set of secrets in memory.
func Open ¶
Open loads and decrypts the secrets store from workDir. If the file does not exist, an empty store is returned. The passphrase is read from CLOOP_SECRET_KEY; an error is returned if it is absent and the file exists.
func (*Store) EnvLines ¶
EnvLines returns KEY=value pairs for every secret, suitable for os/exec Env.
func (*Store) InjectIntoPrompt ¶
InjectIntoPrompt replaces {{KEY}} placeholders in prompt with the corresponding secret values. Unknown placeholders are left intact.
Source Files