Struct SecretsConfig 

pub struct SecretsConfig {

    pub aws_secret_name: Option<String>,
    pub aws_region: Option<String>,
    pub gcp_project: Option<String>,
    pub gcp_secret_name: Option<String>,
    pub azure_vault_url: Option<String>,
    pub azure_secret_name: Option<String>,
    pub keyring_service: String,
    pub vault_addr: Option<String>,
    pub vault_kv_mount: String,
    pub vault_secret_path: Option<String>,
    pub vault_secret_key: String,
    pub vault_namespace: Option<String>,
    pub vault_auth_method: String,
    pub vault_k8s_role: Option<String>,
    pub vault_k8s_mount: String,
    pub vault_k8s_jwt_path: String,
    pub vault_token: Option<String>,
    pub vault_approle_role_id: Option<String>,
    pub vault_approle_secret_id: Option<String>,
    pub vault_approle_mount: String,
    pub vault_skip_verify: bool,
    pub k8s_secret_name: Option<String>,
    pub k8s_namespace: Option<String>,
    pub k8s_secret_key: String,
    pub plaintext_mode: bool,
    pub plaintext: Option<PlaintextSecrets>,
    pub plaintext_bootstrap_seed: Option<String>,
}

Fields

aws_secret_name: Option<String>

aws_region: Option<String>

gcp_project: Option<String>

gcp_secret_name: Option<String>

azure_vault_url: Option<String>

Azure Key Vault DNS URL (e.g. https://my-vault.vault.azure.net/). Required when azure_secret_name is set.

azure_secret_name: Option<String>

Azure Key Vault secret name. Used by azure-secrets backend.

keyring_service: String

vault_addr: Option<String>

HashiCorp Vault server URL (vault-secrets feature). Setting this activates the Vault backend.

vault_kv_mount: String

KV v2 mount path (vault-secrets feature). Default secret.

vault_secret_path: Option<String>

KV v2 secret path under the mount, e.g. webvh/server-secrets (vault-secrets feature). Required when vault_addr is set.

vault_secret_key: String

Field name within the KV v2 secret that holds the JSON secrets envelope (vault-secrets feature). Default seed.

vault_namespace: Option<String>

Vault Enterprise namespace, if any (vault-secrets feature).

vault_auth_method: String

Auth method: kubernetes (default), token, or approle (vault-secrets feature).

vault_k8s_role: Option<String>

Kubernetes auth role name (vault-secrets feature, kubernetes auth method).

vault_k8s_mount: String

Kubernetes auth mount path (vault-secrets feature). Default kubernetes.

vault_k8s_jwt_path: String

File holding the ServiceAccount JWT presented to Vault (vault-secrets feature, kubernetes auth method). Default is the kubelet-mounted projected volume path.

vault_token: Option<String>

Static token (vault-secrets feature, token auth method). Prefer the VAULT_TOKEN env var over hard-coding here.

vault_approle_role_id: Option<String>

AppRole role_id (vault-secrets feature, approle auth method).

vault_approle_secret_id: Option<String>

AppRole secret_id (vault-secrets feature, approle auth method).

vault_approle_mount: String

AppRole mount path (vault-secrets feature). Default approle.

vault_skip_verify: bool

Skip TLS certificate verification — dev/test only (vault-secrets feature).

k8s_secret_name: Option<String>

Kubernetes Secret name holding the JSON secrets envelope (k8s-secrets feature). Setting this activates the Kubernetes backend.

k8s_namespace: Option<String>

Kubernetes namespace the Secret lives in (k8s-secrets feature). When unset, the in-cluster ServiceAccount namespace (or the kubeconfig context namespace) is used, falling back to default.

k8s_secret_key: String

Key within the Secret’s data map that holds the JSON secrets envelope (k8s-secrets feature). Default seed.

plaintext_mode: bool

Explicitly select the plaintext backend even when a keyring backend is compiled in. Without this, a keyring-enabled build always prefers the OS keyring, which panics on a headless host with no Secret Service. The non-interactive recipe sets this for backend = "plaintext"; cloud backends (AWS/GCP/Azure), when configured, still take precedence.

plaintext: Option<PlaintextSecrets>

Plaintext secrets stored directly in the config file. Used when no secure backend (keyring, AWS, GCP) is compiled in, or when plaintext_mode explicitly selects it.

plaintext_bootstrap_seed: Option<String>

Plaintext-mode-only stash for the offline-bootstrap ephemeral seed (base64url-no-pad, 32 raw bytes). Set during phase 1 of the offline wizard when no secure backend is available, and removed at the end of phase 2. Never populated when a secure backend (keyring, AWS, GCP) is active.

Trait Implementations

impl Clone for SecretsConfig

fn clone(&self) -> SecretsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for SecretsConfig

fn default() -> SecretsConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecretsConfig

fn deserialize<__D>( __deserializer: __D, ) -> Result<SecretsConfig, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecretsConfig

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.