Documentation
¶
Overview ¶
Package secrets defines the secret-reference model and the provider port.
Secrets never appear as raw values in configuration files or environment variables: they appear as references ("secretref://<provider>/<path>") that are resolved once at boot by a Provider. This package sits at the base of the dependency graph and imports only the standard library. See docs/blueprint/12-configuration-and-deployment.md §5.
Index ¶
Constants ¶
const Scheme = "secretref://"
Scheme is the URI scheme that marks a string as a secret reference.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Provider ¶
type Provider interface {
// Resolve returns the secret value for ref. Implementations must not log
// the returned value.
Resolve(ctx context.Context, ref Ref) (string, error)
}
Provider resolves secret references to values. Implementations live in adapters (env, cloud secret managers); resolution happens once at boot in the app composition root — never on request or job hot paths.
type Ref ¶
type Ref struct {
Provider string // e.g. "env", "aws", "gcp", "k8s"
Path string // provider-specific path, e.g. "DB_DSN" or "prod/db/dsn"
}
Ref identifies a secret held by a provider, e.g. "secretref://env/DB_DSN".
Source Files