Documentation
¶
Overview ¶
Package secrets wires `w17ctl secrets <leaf>` — the age-tier ("optional key") production-secrets surface. `init` mints a project age keypair (encrypted when the key is present, plain otherwise); `encrypt` turns a plain `.secrets` into a committable `.secrets.age`; `backend` sets the deploy-boundary materialiser. The runtime resolution chain (sdk/go/service/secret) consumes the result.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type BackendCmd ¶
type BackendCmd struct {
LockPath string `name:"lock" placeholder:"PATH" default:"w17/lock.yaml" help:"Path to the lock file."`
Console string `` /* 176-byte string literal not displayed */
SopsFile string `` /* 128-byte string literal not displayed */
Name string `arg:"" name:"name" help:"Materialiser: plain | sops | eso | vault | cloud-csi."`
}
BackendCmd implements `w17ctl secrets backend <name>`. The lock mutation (secrets.backend) goes through the console's EditLock (the console owns the lock); the sops side-file render stays client-side.
func (*BackendCmd) Run ¶
func (c *BackendCmd) Run() error
type CheckCmd ¶
type CheckCmd struct {
// contains filtered or unexported fields
}
CheckCmd is `w17ctl secrets check [--env]` — no private key needed; CI runs it.
type Cmd ¶
type Cmd struct {
Init InitCmd `` /* 242-byte string literal not displayed */
Encrypt EncryptCmd `` /* 159-byte string literal not displayed */
Backend BackendCmd `` /* 273-byte string literal not displayed */
// The infrastructure's deploy env files (deploy/<env>/services/*/.env → .env.enc,
// sops dotenv + age).
Keygen KeygenCmd `` /* 188-byte string literal not displayed */
Seal SealCmd `` /* 166-byte string literal not displayed */
Unseal UnsealCmd `cmd:"" help:"Decrypt deploy/<env>/services/*/.env.enc back to .env for editing."`
Check CheckCmd `` /* 156-byte string literal not displayed */
Rekey RekeyCmd `` /* 158-byte string literal not displayed */
FieldKey FieldKeyCmd `` /* 373-byte string literal not displayed */
}
Cmd is the parent of `w17ctl secrets <leaf>`.
type EncryptCmd ¶
type EncryptCmd struct {
LockPath string `name:"lock" placeholder:"PATH" default:"w17/lock.yaml" help:"Path to the lock file."`
Console string `` /* 176-byte string literal not displayed */
File string `arg:"" name:"file" help:"Plain secrets file to encrypt (e.g. app-business/.secrets). Output is <file>.age."`
}
EncryptCmd implements `w17ctl secrets encrypt <file>`. Read-only on the lock: the age recipients come from the console's DescribeLock; the file encryption stays client-side.
func (*EncryptCmd) Run ¶
func (c *EncryptCmd) Run() error
type FieldKeyCmd ¶
type FieldKeyCmd struct {
Rotate string `` /* 156-byte string literal not displayed */
}
FieldKeyCmd is `w17ctl secrets field-key` — a keyring for W17_FIELD_KEYS, the key of a project's CRYPTED_SECRET columns. Random bytes from this machine, printed once, never written anywhere: it goes into the service's sealed .env like any other secret (one of the few pieces of crypto the client does itself — the key never travels to the console).
func (*FieldKeyCmd) Run ¶
func (c *FieldKeyCmd) Run() error
type InitCmd ¶
type InitCmd struct {
LockPath string `name:"lock" placeholder:"PATH" default:"w17/lock.yaml" help:"Path to the lock file."`
Console string `` /* 176-byte string literal not displayed */
KeyFile string `` /* 173-byte string literal not displayed */
Force bool `` /* 170-byte string literal not displayed */
}
InitCmd implements `w17ctl secrets init`.
type KeygenCmd ¶
type KeygenCmd struct {
Env string `name:"env" required:"" help:"Environment the key is for."`
Save string `` /* 128-byte string literal not displayed */
Force bool `` /* 142-byte string literal not displayed */
LockPath string `name:"lock" placeholder:"PATH" default:"w17/lock.yaml" help:"Path to the lock file (locates the project root)."`
}
KeygenCmd is `w17ctl secrets keygen --env <env>`.
type RekeyCmd ¶
type RekeyCmd struct {
Add []string `` /* 143-byte string literal not displayed */
Remove []string `name:"remove" placeholder:"AGE1…" help:"Remove this public key from the environment first."`
// contains filtered or unexported fields
}
RekeyCmd is `w17ctl secrets rekey [--env]`: re-seal every file's data key for the recipients deploy/.sops.yaml names (after `--add` / `--remove`).
type SealCmd ¶
type SealCmd struct {
// contains filtered or unexported fields
}
SealCmd is `w17ctl secrets seal [--env]`.
type UnsealCmd ¶
type UnsealCmd struct {
Force bool `name:"force" help:"Overwrite a .env whose values differ from the sealed copy."`
Print string `` /* 203-byte string literal not displayed */
JSON bool `` /* 135-byte string literal not displayed */
// contains filtered or unexported fields
}
UnsealCmd is `w17ctl secrets unseal [--env]`.
Source Files