Struct BlobConfig 

pub struct BlobConfig { /* private fields */ }

The blob spine’s configuration.

All three variables are required and none has a default. A default root would put ciphertext somewhere nobody chose, and a default KEK would be a key everyone shares — the failure mode being avoided is a deployment that starts successfully while storing blobs it cannot protect.

Debug is safe to log: the KEK is a SecretBox, which redacts itself. The label beside it is deliberately NOT secret, because it has to travel in the clear inside every container header.

Implementations

impl BlobConfig

pub fn from_env() -> Result<Self>

pub fn from_lookup(get: impl Fn(&str) -> Option<String>) -> Result<Self>

pub fn new(root: PathBuf, kek: [u8; 32], kek_id: String) -> Result<Self>

Build a config directly, for tests and for a caller that already holds the key material.

pub fn root(&self) -> &Path

pub fn kek(&self) -> &SecretBox<[u8; 32]>

pub fn kek_id(&self) -> &str

Trait Implementations

impl Debug for BlobConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.