Documentation
¶
Overview ¶
Package vault stores secret values in an encrypted file in the workspace (vault.enc), so collections and environment files only ever hold references.
The file is AES-256-GCM encrypted. Its key is a random data key kept in the OS keychain or, where there is no keychain (headless Linux, CI), a key derived with Argon2id from FLOWI_VAULT_KEY or a passphrase. The source is recorded in the file, so a vault is always reopened the way it was created.
FLOWI_SECRET_<ENV>_<NAME> environment variables override vault entries without unlocking it. Masker hides secret values in anything shown or saved.
Index ¶
Constants ¶
const Mask = "••••••"
Mask replaces secret values wherever they are shown or saved.
const WorkspaceScope model.ID = "workspace"
WorkspaceScope is the Entry.Collection of secrets that belong to a global environment. Environments are workspace-wide, so their secrets are not tied to any collection. It is not a valid collection id.
Variables ¶
var ErrKeyNotFound = errors.New("vault key not found")
ErrKeyNotFound is returned by KeyStore.Get when there is no such entry.
Functions ¶
func Overridden ¶
Overridden returns the FLOWI_SECRET_<ENV>_<NAME> value for a secret. An empty value counts as unset, as for every FLOWI_ variable.
func OverrideName ¶
OverrideName is the environment variable that overrides a secret: FLOWI_SECRET_<ENV>_<NAME>, upper-cased, with every character that is not a letter or digit replaced by "_".
Types ¶
type Entry ¶
Entry names one secret: a variable of an environment of a collection. Environments are identified by id, so renaming an environment file keeps its secrets.
type KeyStore ¶
type KeyStore interface {
Get(service, account string) (string, error)
Set(service, account, secret string) error
}
KeyStore is the OS keychain.
func OSKeyStore ¶
func OSKeyStore() KeyStore
OSKeyStore returns the operating system keychain (macOS Keychain, Secret Service on Linux, Windows Credential Manager).
type LockedError ¶
type LockedError struct{ Reason string }
LockedError means the vault cannot be opened or created: no key source is available, the key is gone, or the passphrase is wrong.
func (*LockedError) Error ¶
func (e *LockedError) Error() string
type Masker ¶
type Masker struct {
// contains filtered or unexported fields
}
Masker replaces known secret values, in the forms they commonly take on the wire, with Mask. It is immutable; the zero value masks nothing.
type Options ¶
type Options struct {
File string // workspaces/<name>/vault.enc
WorkspaceID model.ID
Keys KeyStore // nil when there is no keychain
Environ []string // for FLOWI_VAULT_KEY and FLOWI_SECRET_*
Passphrase func() (string, error) // nil when no prompt is possible
}
Options configures a vault.
type Vault ¶
type Vault struct {
// contains filtered or unexported fields
}
Vault is the encrypted secrets file. It is unlocked on first use and the key kept for the vault's lifetime. Safe for concurrent use.
func (*Vault) Get ¶
Get returns a secret's value. FLOWI_SECRET_<ENV>_<NAME> wins over the vault and needs no unlock; envName is the environment's name, as users write it in the variable. ok is false when the secret is not set.
Source Files