Documentation
¶
Overview ¶
Package secrets provides a unified interface for retrieving secrets from various providers. This supports environment variables and AWS Secrets Manager, with HashiCorp Vault as a future provider.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrSecretNotFound = errors.New("secret not found") ErrProviderNotEnabled = errors.New("secrets provider not enabled") ErrInvalidConfig = errors.New("invalid secrets provider configuration") )
Common errors
var SecretKeys = struct { JWTSecret string DatabasePassword string RedisPassword string OAuthGitHub struct { ClientID string ClientSecret string } OAuthGoogle struct { ClientID string ClientSecret string } OAuthMicrosoft struct { ClientID string ClientSecret string } SettingsEncryptionKey string SettingsEncryptionPreviousKey string SettingsEncryptionContextID string SettingsEncryptionPreviousContextID string AlertWebhookSecret string }{ JWTSecret: "jwt_secret", DatabasePassword: "database_password", RedisPassword: "redis_password", OAuthGitHub: struct { ClientID string ClientSecret string }{ ClientID: "oauth_github_client_id", ClientSecret: "oauth_github_client_secret", }, OAuthGoogle: struct { ClientID string ClientSecret string }{ ClientID: "oauth_google_client_id", ClientSecret: "oauth_google_client_secret", }, OAuthMicrosoft: struct { ClientID string ClientSecret string }{ ClientID: "oauth_microsoft_client_id", ClientSecret: "oauth_microsoft_client_secret", }, SettingsEncryptionKey: "settings_encryption_key", SettingsEncryptionPreviousKey: "settings_encryption_previous_key", SettingsEncryptionContextID: "settings_encryption_context_id", SettingsEncryptionPreviousContextID: "settings_encryption_previous_context_id", AlertWebhookSecret: "alerting_webhook_secret", }
SecretKeys contains the standard secret key names used by TMI
Functions ¶
This section is empty.
Types ¶
type AWSProvider ¶
type AWSProvider struct {
// contains filtered or unexported fields
}
AWSProvider retrieves secrets from AWS Secrets Manager. It expects secrets to be stored as JSON key-value pairs within a single secret.
func NewAWSProvider ¶
func NewAWSProvider(ctx context.Context, region, secretName string) (*AWSProvider, error)
NewAWSProvider creates a new AWS Secrets Manager provider
func (*AWSProvider) Close ¶
func (p *AWSProvider) Close() error
Close releases resources (no-op for AWS provider)
func (*AWSProvider) GetSecret ¶
GetSecret retrieves a specific key from the AWS secret. The secret is expected to be a JSON object with key-value pairs.
func (*AWSProvider) InvalidateCache ¶
func (p *AWSProvider) InvalidateCache()
InvalidateCache clears the cached secrets, forcing a reload on next access
func (*AWSProvider) ListSecrets ¶
func (p *AWSProvider) ListSecrets(ctx context.Context) ([]string, error)
ListSecrets returns all keys in the AWS secret
type EnvProvider ¶
type EnvProvider struct {
// contains filtered or unexported fields
}
EnvProvider retrieves secrets from environment variables. This is the default provider when no external secrets manager is configured. It maps secret keys to environment variable names using a TMI_SECRET_ prefix.
func NewEnvProvider ¶
func NewEnvProvider() *EnvProvider
NewEnvProvider creates a new environment variable secrets provider
func (*EnvProvider) Close ¶
func (p *EnvProvider) Close() error
Close is a no-op for the environment provider
func (*EnvProvider) GetSecret ¶
GetSecret retrieves a secret from environment variables. It looks for an environment variable named TMI_SECRET_<KEY> (uppercase). For example, key "jwt_secret" maps to TMI_SECRET_JWT_SECRET.
func (*EnvProvider) ListSecrets ¶
func (p *EnvProvider) ListSecrets(_ context.Context) ([]string, error)
ListSecrets returns all TMI_SECRET_* environment variable keys
type FileProvider ¶
type FileProvider struct {
// contains filtered or unexported fields
}
FileProvider reads one secret per file from a directory, the shape of a Kubernetes Secret volume or a umask-077 staging directory.
func NewFileProvider ¶
func NewFileProvider(dir string) *FileProvider
func (*FileProvider) Close ¶
func (p *FileProvider) Close() error
func (*FileProvider) ListSecrets ¶
func (p *FileProvider) ListSecrets(_ context.Context) ([]string, error)
func (*FileProvider) Name ¶
func (p *FileProvider) Name() string
type Provider ¶
type Provider interface {
// GetSecret retrieves a secret value by its key.
// Returns ErrSecretNotFound if the secret doesn't exist.
GetSecret(ctx context.Context, key string) (string, error)
// ListSecrets returns a list of available secret keys.
// This may not be supported by all providers (returns empty list if unsupported).
ListSecrets(ctx context.Context) ([]string, error)
// Name returns the provider's identifier (e.g., "env", "aws")
Name() string
// Close releases any resources held by the provider
Close() error
}
Provider defines the interface for secrets providers
func NewProvider ¶
NewProvider creates a new secrets provider based on configuration. If no provider is configured, it defaults to the environment variable provider.
type ProviderType ¶
type ProviderType string
ProviderType represents the type of secrets provider
const ( ProviderTypeEnv ProviderType = "env" ProviderTypeFile ProviderType = "file" ProviderTypeAWS ProviderType = "aws" ProviderTypeVault ProviderType = "vault" // Future: HashiCorp Vault )
Provider type constants
Source Files