Documentation
¶
Overview ¶
Package credstore is the agent's encrypted store for database credential profiles. Profiles live in <data dir>/credentials.json, encrypted with AES-256-GCM under a random key kept in <data dir>/credentials.key (0600, so only the agent's user can read it; on Windows the key is additionally wrapped with DPAPI for the service account). Passwords therefore never sit in agent.yaml in clear text, and only the profile names and engines are ever reported to the server.
Index ¶
Constants ¶
const ( StoreFile = "credentials.json" KeyFile = "credentials.key" )
File names inside the data directory
Variables ¶
var ErrNotFound = errors.New("profile not found")
ErrNotFound is returned for an unknown profile name
Functions ¶
func Summaries ¶
func Summaries(profiles map[string]dbspec.CredentialProfile) []dbspec.ProfileSummary
Summaries lists names, engines and users of a profile set (never passwords)
Types ¶
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store is a handle on the encrypted file; every operation reads and writes it whole
func (*Store) Load ¶
func (s *Store) Load() (map[string]dbspec.CredentialProfile, error)
Load returns the profiles (an empty map when no store exists)
Source Files