Documentation
¶
Overview ¶
Package file provides a file-based vault implementation. Secrets are stored as individual files in a directory.
Usage:
v, err := file.New(file.Config{
Directory: "/path/to/secrets",
})
secret, err := v.Get(ctx, "api-key") // reads /path/to/secrets/api-key
Index ¶
- Variables
- type Config
- type Provider
- func (p *Provider) Capabilities() vault.Capabilities
- func (p *Provider) Close() error
- func (p *Provider) Delete(ctx context.Context, path string) (err error)
- func (p *Provider) Exists(ctx context.Context, path string) (_ bool, err error)
- func (p *Provider) Get(ctx context.Context, path string) (_ *vault.Secret, err error)
- func (p *Provider) List(ctx context.Context, prefix string) ([]string, error)
- func (p *Provider) Name() string
- func (p *Provider) Set(ctx context.Context, path string, secret *vault.Secret) (err error)
Constants ¶
This section is empty.
Variables ¶
View Source
var ErrInsecurePermissions = errors.New("secret file is accessible by group or others")
ErrInsecurePermissions is returned by Get for a secret file that group or others can access. Restrict the file to its owner (chmod 600), or set Config.AllowInsecurePermissions.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// Directory is the base directory for storing secrets.
Directory string
// Extension is the file extension for secret files (default: none).
Extension string
// JSONFormat stores secrets as JSON with metadata (default: false, plain text).
JSONFormat bool
// FileMode is the permission mode for secret files (default: 0600).
FileMode os.FileMode
// DirMode is the permission mode for directories (default: 0700).
DirMode os.FileMode
// ReadOnly prevents write and delete operations.
ReadOnly bool
// AllowInsecurePermissions lets Get read secret files that group or
// others can access. By default such files are refused with
// [ErrInsecurePermissions], because a secret any local user can read is
// not secret. Set it only where the mode is outside your control and
// access is restricted some other way. Platforms that do not enforce
// file modes, such as Windows, are never refused.
AllowInsecurePermissions bool
}
Config holds configuration for the file provider.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements vault.Vault with file-based storage.
func (*Provider) Capabilities ¶
func (p *Provider) Capabilities() vault.Capabilities
Capabilities returns the provider capabilities.
Click to show internal directories.
Click to hide internal directories.