Documentation
¶
Overview ¶
Package secrets provides authenticated encryption (AES-256-GCM) for user-scoped secrets stored in the database — here, each user's GitLab personal access token. The master key (KEK) lives only in the server config/env (secrets.key), never in the database or git.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoKey = errors.New("no encryption key configured (set secrets.key)")
ErrNoKey is returned when a seal/open is attempted without a configured KEK.
Functions ¶
This section is empty.
Types ¶
type SealedValue ¶
type SealedValue struct {
KeyVersion int `json:"keyVersion"`
Nonce []byte `json:"nonce"`
Ciphertext []byte `json:"ciphertext"`
}
SealedValue is an encrypted secret as stored in the database. It carries everything needed to decrypt except the key: the key version, the per-value random nonce and the GCM ciphertext (which already includes the authentication tag).
type Sealer ¶
type Sealer struct {
// contains filtered or unexported fields
}
Sealer seals and opens secrets with a fixed KEK. A nil *Sealer means "no key configured" and every operation fails closed with ErrNoKey.
func NewSealer ¶
NewSealer builds a Sealer from a base64-encoded 32-byte (AES-256) key. An empty key returns (nil, nil): the caller treats "no KEK configured" as a soft state and fails closed only when a secret operation is actually attempted. A malformed key is an error.
Source Files