Enum BackendCred 

pub enum BackendCred {
    VaultToken {
        token: SecretString,
        addr: Option<String>,
    },
    VaultAppRole {
        role_id: String,
        secret_id: SecretString,
        addr: Option<String>,
    },
    SpiffeSigner {
        key_pem: SecretString,
        spiffe_id: String,
    },
    DbKeystoreDek {
        dek: SecretArray<32>,
    },
    OnePassword {
        provider_uri: String,
        project: String,
        profile: String,
    },
    AwsKms {
        region: String,
        profile: String,
    },
    GcpKms {
        project: String,
        location: String,
        key_ring: String,
        service_account_json: Option<SecretString>,
    },
    Opaque {
        kind: String,
        secret: SecretBytes,
    },
}

A single backend’s bootstrap credential. Secret fields are Zeroizing.

Serialized with serde’s external tagging (a { "<variant>": { … } } object), the same style the wire protocol uses.

Variants

VaultToken

Vault static token (the bundle create --backend …,token-file= cred). Dev / simple setups.

Fields

token: SecretString

The bearer token sent as X-Vault-Token.

addr: Option<String>

Optional per-cred address override; otherwise the broker’s --vault-addr applies.

VaultAppRole

Vault AppRole: secret_id (+ role_id) exchanged for a short-lived token at startup. Recommended production default (§4).

Fields

role_id: String

Non-secret role_id.

secret_id: SecretString

Secret secret_id (zeroized on drop).

addr: Option<String>

Optional per-cred address override.

SpiffeSigner

SPIFFE/JWT-SVID signing key for the spiffe backend path: a private key the broker uses to self-issue an SVID, exchanged via bao jwt auth.

Fields

key_pem: SecretString

PEM-encoded private signing key (zeroized on drop).

spiffe_id: String

SPIFFE id stamped into the SVID sub.

DbKeystoreDek

Future value-store backend (db-keystore): the DEK that opens the local DB.

Fields

dek: SecretArray<32>

32-byte data-encryption key (zeroized on drop).

OnePassword

1Password provider configuration.

Fields

provider_uri: String

Provider URI, for example onepassword://vault or onepassword+token://token@vault.

project: String

Item-title project namespace.

profile: String

Item-title profile.

AwsKms

AWS KMS transit backend addressing. Auth is the ambient AWS credential chain (env / profile / IAM role / IMDS), so no secret is sealed here: this variant carries only non-secret addressing.

Fields

region: String

AWS region, for example us-east-1. Empty ⇒ SDK default resolution.

profile: String

Optional named profile from ~/.aws/config. Empty ⇒ default chain.

GcpKms

GCP Cloud KMS transit backend addressing. Auth defaults to Application Default Credentials; when service_account_json is present, the whole service-account key file is sealed as one opaque secret. Crypto-key names route under projects/{project}/locations/{location}/keyRings/{key_ring}.

Fields

project: String

GCP project id.

location: String

KMS location, for example global or us-west1.

key_ring: String

Key ring name that holds the crypto keys.

service_account_json: Option<SecretString>

Optional service-account JSON key. None uses ambient ADC.

Opaque

Escape hatch for a backend kind not yet modelled: opaque labelled bytes.

Fields

kind: String

Operator-facing kind label.

secret: SecretBytes

Opaque secret bytes (zeroized on drop).

Implementations

impl BackendCred

pub const fn kind(&self) -> &'static str

Short, stable name for the variant (for audit/logging, never the bytes).

Trait Implementations

impl Clone for BackendCred

fn clone(&self) -> BackendCred

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for BackendCred

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for BackendCred

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for BackendCred

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.