Help us shape the future of Go! Take the 2026 Go Developer Survey

file

package
v0.6.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 25, 2026 License: MIT Imports: 11 Imported by: 4

Documentation

Overview

Package file provides a file-based vault implementation. Secrets are stored as individual files in a directory.

Usage:

v, err := file.New(file.Config{
    Directory: "/path/to/secrets",
})
secret, err := v.Get(ctx, "api-key")  // reads /path/to/secrets/api-key

Index

Constants

This section is empty.

Variables

View Source
var ErrInsecurePermissions = errors.New("secret file is accessible by group or others")

ErrInsecurePermissions is returned by Get for a secret file that group or others can access. Restrict the file to its owner (chmod 600), or set Config.AllowInsecurePermissions.

Functions

This section is empty.

Types

type Config

type Config struct {
	// Directory is the base directory for storing secrets.
	Directory string

	// Extension is the file extension for secret files (default: none).
	Extension string

	// JSONFormat stores secrets as JSON with metadata (default: false, plain text).
	JSONFormat bool

	// FileMode is the permission mode for secret files (default: 0600).
	FileMode os.FileMode

	// DirMode is the permission mode for directories (default: 0700).
	DirMode os.FileMode

	// ReadOnly prevents write and delete operations.
	ReadOnly bool

	// AllowInsecurePermissions lets Get read secret files that group or
	// others can access. By default such files are refused with
	// [ErrInsecurePermissions], because a secret any local user can read is
	// not secret. Set it only where the mode is outside your control and
	// access is restricted some other way. Platforms that do not enforce
	// file modes, such as Windows, are never refused.
	AllowInsecurePermissions bool
}

Config holds configuration for the file provider.

type Provider

type Provider struct {
	// contains filtered or unexported fields
}

Provider implements vault.Vault with file-based storage.

func New

func New(config Config) (*Provider, error)

New creates a new file provider with the given configuration.

func (*Provider) Capabilities

func (p *Provider) Capabilities() vault.Capabilities

Capabilities returns the provider capabilities.

func (*Provider) Close

func (p *Provider) Close() error

Close is a no-op for the file provider.

func (*Provider) Delete

func (p *Provider) Delete(ctx context.Context, path string) (err error)

Delete removes a secret file.

func (*Provider) Exists

func (p *Provider) Exists(ctx context.Context, path string) (_ bool, err error)

Exists checks if a secret file exists.

func (*Provider) Get

func (p *Provider) Get(ctx context.Context, path string) (_ *vault.Secret, err error)

Get retrieves a secret from a file.

func (*Provider) List

func (p *Provider) List(ctx context.Context, prefix string) ([]string, error)

List returns all secret paths matching the prefix.

func (*Provider) Name

func (p *Provider) Name() string

Name returns the provider name.

func (*Provider) Set

func (p *Provider) Set(ctx context.Context, path string, secret *vault.Secret) (err error)

Set stores a secret to a file.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL