secrets

type AWSSM ¶

type AWSSM struct {
	// contains filtered or unexported fields
}

AWSSM resolves "awssm://..." refs from AWS Secrets Manager, reusing the standard AWS credential chain (env / shared config / instance role) — the same chain the S3 storage backend uses, so no separate credential wiring.

Ref shapes:

• awssm://<secret-id> → the secret's whole SecretString
• awssm://<secret-id>#<key> → field <key> of the secret's JSON object

The #<key> selector matters because Secrets Manager secrets are commonly JSON (e.g. {"username":...,"password":...}); without it a ref would resolve to the entire JSON blob rather than the one field a DSN needs.

func NewAWSSM(ctx context.Context, region string) (*AWSSM, error)

func (a *AWSSM) Resolve(ref string) (string, error)

func (AWSSM) Scheme() string

type Backend ¶

type Backend interface {
	Scheme() string // "env", "keychain", "vault", "" for passthrough
	Resolve(ref string) (string, error)
}

Backend resolves SecretRef values it claims via Scheme().

type Env ¶

type Env struct{}

Env resolves "env:VAR" refs to os.Getenv("VAR").

func (Env) Resolve(ref string) (string, error)

func (Env) Scheme() string

type Keychain ¶

type Keychain struct{}

Keychain resolves "keychain://..." refs from the OS credential store — macOS Keychain, Windows Credential Manager, or the Linux Secret Service — via go-keyring, which abstracts all three behind one call.

Ref shapes:

• keychain://<service>/<account> → keyring.Get(service, account)
• keychain://<account> → keyring.Get("siphon", account)

The two-segment form addresses an arbitrary stored credential; the short form is the common case (a siphon-owned secret named <account>).

func (Keychain) Resolve(ref string) (string, error)

func (Keychain) Scheme() string

type Passthrough ¶

type Passthrough struct{}

Passthrough returns the ref as-is. Used for literal cleartext values (or for values that have already been env-interpolated at config-load time).

func (Passthrough) Resolve(ref string) (string, error)

func (Passthrough) Scheme() string

type Resolver ¶

type Resolver struct {
	// contains filtered or unexported fields
}

Resolver dispatches refs to the matching backend.

func NewResolver(backends ...Backend) *Resolver

func (r *Resolver) Resolve(ref string) (string, error)