Documentation
¶
Overview ¶
Package secrets provides a unified interface for retrieving secrets from various providers. This supports environment variables and AWS Secrets Manager, with HashiCorp Vault as a future provider.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrSecretNotFound = errors.New("secret not found") ErrProviderNotEnabled = errors.New("secrets provider not enabled") ErrInvalidConfig = errors.New("invalid secrets provider configuration") )
Common errors
var SecretKeys = struct { JWTSecret string DatabasePassword string RedisPassword string OAuthGitHub struct { ClientID string ClientSecret string } OAuthGoogle struct { ClientID string ClientSecret string } OAuthMicrosoft struct { ClientID string ClientSecret string } SettingsEncryptionKey string SettingsEncryptionPreviousKey string SettingsEncryptionContextID string SettingsEncryptionPreviousContextID string AlertWebhookSecret string }{ JWTSecret: "jwt_secret", DatabasePassword: "database_password", RedisPassword: "redis_password", OAuthGitHub: struct { ClientID string ClientSecret string }{ ClientID: "oauth_github_client_id", ClientSecret: "oauth_github_client_secret", }, OAuthGoogle: struct { ClientID string ClientSecret string }{ ClientID: "oauth_google_client_id", ClientSecret: "oauth_google_client_secret", }, OAuthMicrosoft: struct { ClientID string ClientSecret string }{ ClientID: "oauth_microsoft_client_id", ClientSecret: "oauth_microsoft_client_secret", }, SettingsEncryptionKey: "settings_encryption_key", SettingsEncryptionPreviousKey: "settings_encryption_previous_key", SettingsEncryptionContextID: "settings_encryption_context_id", SettingsEncryptionPreviousContextID: "settings_encryption_previous_context_id", AlertWebhookSecret: "alerting_webhook_secret", }
SecretKeys contains the standard secret key names used by TMI
Functions ¶
This section is empty.
Types ¶
type AWSProvider ¶
type AWSProvider struct {
// contains filtered or unexported fields
}
AWSProvider retrieves secrets from AWS Secrets Manager. It expects secrets to be stored as JSON key-value pairs within a single secret. SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: secrets provider that fetches and caches JSON key-value pairs from AWS Secrets Manager
func NewAWSProvider ¶
func NewAWSProvider(ctx context.Context, region, secretName string) (*AWSProvider, error)
NewAWSProvider creates a new AWS Secrets Manager provider SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: connect to AWS Secrets Manager and build a caching AWSProvider for the given secret
func (*AWSProvider) Close ¶
func (p *AWSProvider) Close() error
Close releases resources (no-op for AWS provider) SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: release provider resources; no-op for the AWS provider (pure)
func (*AWSProvider) GetSecret ¶
GetSecret retrieves a specific key from the AWS secret. The secret is expected to be a JSON object with key-value pairs. SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: fetch a secret value by key from the AWS Secrets Manager cache, loading on first call
func (*AWSProvider) InvalidateCache ¶
func (p *AWSProvider) InvalidateCache()
InvalidateCache clears the cached secrets, forcing a reload on next access SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: clear the in-memory secret cache to force a reload on next access (mutates shared state)
func (*AWSProvider) ListSecrets ¶
func (p *AWSProvider) ListSecrets(ctx context.Context) ([]string, error)
ListSecrets returns all keys in the AWS secret SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: list all secret keys available in the cached AWS secret
func (*AWSProvider) Name ¶
func (p *AWSProvider) Name() string
Name returns the provider name SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: return the provider type identifier for this AWS provider (pure)
type EnvProvider ¶
type EnvProvider struct {
// contains filtered or unexported fields
}
EnvProvider retrieves secrets from environment variables. This is the default provider when no external secrets manager is configured. It maps secret keys to environment variable names using a TMI_SECRET_ prefix. SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: secrets provider that reads values from TMI_SECRET_* environment variables
func NewEnvProvider ¶
func NewEnvProvider() *EnvProvider
NewEnvProvider creates a new environment variable secrets provider SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: build an environment-variable secrets provider with the TMI_SECRET_ prefix (pure)
func (*EnvProvider) Close ¶
func (p *EnvProvider) Close() error
Close is a no-op for the environment provider SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: no-op close for the environment variable secrets provider (pure)
func (*EnvProvider) GetSecret ¶
GetSecret retrieves a secret from environment variables. It looks for an environment variable named TMI_SECRET_<KEY> (uppercase). For example, key "jwt_secret" maps to TMI_SECRET_JWT_SECRET. SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: fetch a secret value from the TMI_SECRET_<KEY> environment variable
func (*EnvProvider) ListSecrets ¶
func (p *EnvProvider) ListSecrets(_ context.Context) ([]string, error)
ListSecrets returns all TMI_SECRET_* environment variable keys SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: list all secret keys available in TMI_SECRET_* environment variables (pure)
func (*EnvProvider) Name ¶
func (p *EnvProvider) Name() string
Name returns the provider name SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: return the provider type name for the environment variable secrets provider (pure)
type FileProvider ¶
type FileProvider struct {
// contains filtered or unexported fields
}
FileProvider reads one secret per file from a directory, the shape of a Kubernetes Secret volume or a umask-077 staging directory. SEM@3b682947: secrets provider that reads each secret from <dir>/<key> (reads files)
func NewFileProvider ¶
func NewFileProvider(dir string) *FileProvider
SEM@3b682947: build a directory-backed secrets provider (pure)
func (*FileProvider) Close ¶
func (p *FileProvider) Close() error
SEM@3b682947: no-op close of the secrets provider (pure)
func (*FileProvider) GetSecret ¶
SEM@3b682947: fetch a secret from the file named after its key, rejecting path traversal (reads files)
func (*FileProvider) ListSecrets ¶
func (p *FileProvider) ListSecrets(_ context.Context) ([]string, error)
SEM@3b682947: list secret keys as the regular file names in the directory (reads files)
func (*FileProvider) Name ¶
func (p *FileProvider) Name() string
SEM@3b682947: return the provider type name (pure)
type Provider ¶
type Provider interface {
// GetSecret retrieves a secret value by its key.
// Returns ErrSecretNotFound if the secret doesn't exist.
GetSecret(ctx context.Context, key string) (string, error)
// ListSecrets returns a list of available secret keys.
// This may not be supported by all providers (returns empty list if unsupported).
ListSecrets(ctx context.Context) ([]string, error)
// Name returns the provider's identifier (e.g., "env", "aws")
Name() string
// Close releases any resources held by the provider
Close() error
}
Provider defines the interface for secrets providers SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: interface for fetching and listing secrets from a backing store
func NewProvider ¶
NewProvider creates a new secrets provider based on configuration. If no provider is configured, it defaults to the environment variable provider. SEM@3b682947: build a secrets provider from config, defaulting to env
type ProviderType ¶
type ProviderType string
ProviderType represents the type of secrets provider SEM@fe6575f1c15d84b67ee9853a0e59055c1ebe44b6: identify a secrets backend kind (pure)
const ( ProviderTypeEnv ProviderType = "env" ProviderTypeFile ProviderType = "file" ProviderTypeAWS ProviderType = "aws" ProviderTypeVault ProviderType = "vault" // Future: HashiCorp Vault )
Provider type constants
Source Files