Struct SecretsConfig 

pub struct SecretsConfig {
    pub envelope: String,
    pub kek_file: Option<PathBuf>,
    pub vault: Option<VaultSecretsConfig>,
}

secrets section — envelope encryption for private keys at rest.

Fields

envelope: String

Backend: "local" (machine-local AES-256-GCM KEK) or "vault" (Vault Transit). Empty/other ⇒ no wrapping. In a cluster a local KEK must be the same file on every node (wrapped certs replicate); Vault avoids that.

kek_file: Option<PathBuf>

Local-KEK key file (envelope = "local"). Default <data-dir>/secrets/kek. Auto-generated 0600 if absent.

vault: Option<VaultSecretsConfig>

Vault Transit config (envelope = "vault").

Trait Implementations

impl Clone for SecretsConfig

fn clone(&self) -> SecretsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecretsConfig

fn default() -> SecretsConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecretsConfig

where SecretsConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.