Documentation
¶
Overview ¶
Package secrets seals the server's stored secrets (PBS API tokens, backup encryption keys) with a master key held outside the database, so a database dump alone does not expose them. AES-256-GCM, one random nonce per value; the sealed form is "v1:" + base64(nonce || ciphertext), which lets reads tell sealed values from legacy plaintext while those are migrated.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func LoadOrCreateKeyFile ¶
LoadOrCreateKeyFile reads the master key from path, creating a random one (mode 0600) when the file does not exist. created reports whether it was generated.
Types ¶
type Sealer ¶
type Sealer struct {
// contains filtered or unexported fields
}
Sealer seals and opens values with one master key
func (*Sealer) OpenString ¶
OpenString is Open for strings
func (*Sealer) Seal ¶
Seal encrypts plain; an empty value stays empty (nothing stored, nothing to protect)
func (*Sealer) SealString ¶
SealString is Seal for strings
Source Files