Struct FieldEncryption 

pub struct FieldEncryption {
    pub columns: BTreeMap<String, String>,
    pub keys: BTreeMap<String, String>,
}

Which columns are encrypted in the .csx format, and where their keys come from.

The keys are named, never written here. A keys entry is the name of an environment variable holding the base64 of 32 bytes, so the configuration file carries no secret — which is what makes this worth having over full-disk encryption, whose key is on the machine too.

[database.field_encryption]
columns = { patient_id = "phi-2026", diagnosis = "phi-2026" }
keys    = { phi-2026 = "CHRONIX_FIELD_KEY_PHI" }

Column names are global, not per measurement. Only a field may be encrypted: a tag is part of the series key, which is stored in plaintext beside the segment, and every scan ranges on the time column.

Declaring several key ids at once is a rotation — segments written under the old one stay readable. Every declared key must resolve at startup, including one no column currently names.

Fields

columns: BTreeMap<String, String>

Column name → the id of the key that encrypts it.

keys: BTreeMap<String, String>

Key id → the environment variable holding its base64-encoded 32 bytes.

Implementations

impl FieldEncryption

pub fn is_empty(&self) -> bool

Whether anything is encrypted at all.

pub fn covers(&self, column: &str) -> bool

Whether column is declared encrypted.

pub fn validate(&self) -> Result<(), ConfigError>

Check the declaration is self-consistent.

Errors

ConfigError::Validation if a column names a key that is not declared, if a name is empty, or if the time column is named — a timestamp cannot be encrypted, because every scan ranges on it and every retention decision reads it.

Trait Implementations

impl Clone for FieldEncryption

fn clone(&self) -> FieldEncryption

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FieldEncryption

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for FieldEncryption

fn default() -> FieldEncryption

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for FieldEncryption

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for FieldEncryption

impl PartialEq for FieldEncryption

fn eq(&self, other: &FieldEncryption) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for FieldEncryption

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for FieldEncryption