Documentation
¶
Overview ¶
Package crypto encrypts provider API keys at rest with AES-256-GCM under a master key from the environment, so a database leak never yields usable secrets.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoKey = errors.New("crypto: master key not configured")
Functions ¶
func GenerateKey ¶
GenerateKey returns a fresh base64-encoded 32-byte key for first-run bootstrap.
Types ¶
type SecretBox ¶
type SecretBox struct {
// contains filtered or unexported fields
}
SecretBox seals and opens secrets with one 32-byte key.
func LoadOrGenerate ¶
LoadOrGenerate builds a SecretBox from base64Key. When the key is empty it generates an ephemeral one and returns it in generated (non-empty) so the caller can warn the operator to persist it — provider keys sealed with an ephemeral key are lost on restart. A malformed or wrong-length key is an error.
func New ¶
New builds a SecretBox from a base64-encoded 32-byte key. An empty key returns ErrNoKey so callers can decide whether to bootstrap one.
Source Files