Documentation
¶
Overview ¶
Package secrets provides AES-256-GCM encryption for application secrets. Secrets are encrypted at rest and loaded from environment variables or an encrypted .secrets file.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Encrypt ¶
Encrypt encrypts plaintext using AES-256-GCM with the given 32-byte key. The returned string is URL-safe base64: nonce (12 bytes) || ciphertext || tag.
func GenerateKey ¶
GenerateKey generates a new cryptographically random 32-byte key and returns it in the "base64:<std-base64>" form suitable for APP_KEY.
Types ¶
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager holds and provides access to application secrets. Secrets can be encrypted at rest and decrypted on demand using the app key.
func New ¶
New creates a Manager. appKey is the raw application secret (e.g. APP_KEY env var). If appKey is empty, a random EPHEMERAL key is generated (useful for testing): anything encrypted with it is unrecoverable after the process exits, so a loud warning is logged.
func (*Manager) Decrypt ¶
Decrypt decrypts a base64url-encoded ciphertext produced by Encrypt.
plain, err := manager.Decrypt(encrypted)
func (*Manager) Encrypt ¶
Encrypt encrypts plaintext using AES-256-GCM and returns a base64url-encoded ciphertext.
encrypted, err := manager.Encrypt("my-secret-password")
Source Files