vault

Overview ¶

Package vault registers the "vault" encryption provider backed by HashiCorp Vault Transit. DEKs are loaded from the application database (encryption_deks table) at startup. Vault Transit is used only to wrap/unwrap DEKs at load time — never per-request.