Documentation
¶
Overview ¶
Package local implements the secrets adapter, encrypted at rest with the key on disk (R-190).
Values cross this boundary wrapped in secret.Value, which refuses to render (R-194). No plaintext column exists anywhere in the schema.
Index ¶
- Constants
- func Info() api.KindInfo
- type Adapter
- func (a *Adapter) Category() api.Category
- func (a *Adapter) Configure(_ context.Context, raw json.RawMessage) error
- func (a *Adapter) Delete(context.Context, api.StoredRef) error
- func (a *Adapter) Get(_ context.Context, ref api.StoredRef) (secret.Value, error)
- func (a *Adapter) HealthCheck(context.Context) error
- func (a *Adapter) Kind() string
- func (a *Adapter) Put(_ context.Context, ref api.SecretRef, v secret.Value) (api.StoredRef, error)
- type Config
Constants ¶
const DefaultKeyPath = "/var/lib/pando/secrets.key"
DefaultKeyPath is where the encryption key lives unless configured otherwise. Exported because the DR bundle has to find it (R-212).
const KeySize = 32
KeySize is the AES-256 key length.
const Kind = "local"
Kind is the adapter's kind string.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Adapter ¶
type Adapter struct {
// contains filtered or unexported fields
}
Adapter encrypts secrets at rest with a key on disk (R-190).
The threat this defends against is a leaked database dump or backup, not a compromised host: an attacker who can read the key file can read the secrets. R-042's posture applies here too — this must be secure, and it is not claimed to be the strongest option. An install with real requirements configures an external secrets adapter, and the interface exists so that drops in without touching core.
func (*Adapter) Delete ¶
Delete is a no-op for this adapter: the ciphertext lives in Pando's own database row, and core removes it. An external adapter would delete remotely.
func (*Adapter) Put ¶
Put encrypts a value and returns a reference holding the ciphertext.
The app ID and key are bound into the ciphertext as additional authenticated data, so a ciphertext lifted from one app's row cannot be decrypted as another's. Without that, a database-level swap of two rows would silently hand one app another's credential.
Source Files