Documentation
¶
Overview ¶
Package vault is Atlas's engine-internal encrypted secret store: worker credentials sealed at rest with AES-256-GCM under a master key that never leaves the operator's control (ADR-0069), on by default with a generated key file when no operator key is supplied (ADR-0070).
It exists as its own package so the boundary is enforced rather than merely intended: nothing here returns a plaintext secret except Vault.Get, nothing writes the master key anywhere but the key file, and a caller cannot reach past the API into a record. The rest of the server holds a *Vault and resolves secret *references*, so a credential never sits in a compiled process, an event, or a log line.
Index ¶
Constants ¶
const ( KeyEnv = "ATLAS_VAULT_KEY" KeyFileEnv = "ATLAS_VAULT_KEY_FILE" )
Environment variables that configure the vault master key. The key is 32 bytes (AES-256), given as hex (64 chars) or base64. An operator key from either of these is preferred and, per ADR-0069, is NEVER written to disk by Atlas. When neither is set the vault is on by default and generates its own key file (ADR-0070).
Variables ¶
This section is empty.
Functions ¶
func ResolveKey ¶
ResolveKey sources the master key with operator precedence (ADR-0070): an operator key from the environment (ATLAS_VAULT_KEY / ATLAS_VAULT_KEY_FILE) wins and is never written to disk; absent one, the key is loaded from keyFile, or generated into it (mode 0600) so the vault is on by default without provisioning. source is "env", "file", or "generated" — the caller logs the generated case, which trades a weaker at-rest guarantee (key beside the ciphertext) for turnkey operation.
Types ¶
type Meta ¶
type Meta struct {
Name string `json:"name"`
KeyID string `json:"keyId"`
CreatedAt int64 `json:"createdAt"`
UpdatedAt int64 `json:"updatedAt"`
}
Meta is the value-free view of a secret returned by the API and List: it proves a secret exists and under which key, but never reveals the value.
type Vault ¶
type Vault struct {
// contains filtered or unexported fields
}
Vault is the engine-internal encrypted secret store (ADR-0069, closing the A3 option deferred by ADR-0041). It owns a sidecar directory — one JSON file per secret, hex-named, atomic write + dir fsync, the connectorStore pattern — and an AES-256-GCM cipher built from the master key. Like the other sidecar stores it is owned by the run-loop goroutine, so it needs no locking; and it writes only ciphertext, so no secret value ever reaches the WAL, an event, or a variable (I6).
func New ¶
New opens (creating if needed) the vault directory and builds the AES-256-GCM cipher from a 32-byte master key.
func (*Vault) Get ¶
Get returns the decrypted value for a name, ok=false when no such secret exists. A record sealed under a different master key, or one that has been tampered with, is an error rather than a silent miss.
Source Files