Documentation
¶
Overview ¶
Package tokenwatch watches the Vault token file for replacement and invokes a callback when it is created or updated, so a running daemon picks up a token freshly written by `dotvault login` (or any other external writer) without waiting for the lifecycle manager's periodic re-read.
On Linux it uses inotify on the token file's parent directory. The directory — not the file — is the robust target: atomic writers (`vault login`, dotvault's own temp-file+rename) replace the inode rather than writing in place, so an inode-level watch would go deaf after the first rotation. It subscribes to creation and write-completion events and deliberately ignores deletes — a removed token file leaves the daemon operating on its current in-memory token until a replacement appears.
This replaces the previously shipped systemd `.path` unit, which achieved the same nudge out-of-process by SIGHUP-ing the daemon on every change to the token file. Doing it in-process drops two unit files and works regardless of the service manager.
On every other platform Watch is a no-op that blocks until ctx is cancelled, so the daemon can wire it unconditionally. Non-Linux platforms had no path-unit equivalent to replace; the manual nudge remains available as SIGHUP (where delivered — macOS and the BSDs) and as the tray's "Reload config" entry on Windows. Function-level docs live with the build-tag-specific declarations so `go doc` picks up the right one per platform.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Watcher ¶ added in v0.21.0
type Watcher struct {
// contains filtered or unexported fields
}
Watcher holds a live inotify subscription to the token file's parent directory. Splitting registration (New) from the read loop (Run) lets the daemon make InotifyAddWatch synchronous — completing before any "no token, idle" decision — so a token written in the gap between registration and the loop starting is queued by the kernel and delivered once Run begins, rather than being lost (inotify only delivers events that occur after InotifyAddWatch returns).
func New ¶ added in v0.21.0
New registers an inotify watch on the parent directory of path and returns a Watcher ready to Run. Registration is synchronous: on return the kernel is already queuing events for path's basename, so a caller that issues a reconciling read after New (to catch a token that predates the watch) plus Run (to catch everything after) cannot miss a write. onChange runs on the Run goroutine, so keep it cheap; the daemon passes LifecycleManager.Reload, a non-blocking channel nudge.
The directory rather than the file is watched because atomic writers replace the inode; a file-level watch would survive only until the first rotation. Watching the directory and filtering events by name keeps the subscription alive across arbitrarily many replacements.
func (*Watcher) Close ¶ added in v0.21.0
Close releases the inotify fd. It is safe to call after Run returns.
func (*Watcher) Run ¶ added in v0.21.0
Run blocks reading the inotify fd registered by New, calling onChange whenever an event names the watched file. It returns when ctx is cancelled — yielding ctx.Err() — or on an unrecoverable read error. Run does not close the fd; call Close (typically via defer) to release it.
Source Files