Struct Secret 

pub struct Secret {
    pub id: String,
    pub host: String,
    pub header: String,
    pub source: Source,
    pub plain_http: bool,
    pub port: Option<u16>,
    pub tls: Option<Tls>,
    pub allow: Vec<String>,
}

One brokered secret. Its Debug output names only the id: where the value lives and where it goes say which secrets exist.

Fields

id: String

Stable identifier: lowercase letters, digits and -. It names the placeholder and appears in audit rows; the value never does.

host: String

The one host (a lowercase DNS name or IPv4 literal, no pattern) whose requests receive the secret.

header: String

The request header the secret goes in (Authorization, X-Api-Key).

source: Source

Where OpenMoat reads the value, written { env: NAME } and so on.

plain_http: bool

Also inject into plain-HTTP requests, which carry the value in clear text. Off unless set: without it a plain-HTTP request keeps the placeholder.

port: Option<u16>

The port of the plain-HTTP requests that get the value, 1 to 65535; 80 when unset. A request to another port of the host keeps the placeholder. Only with plain_http.

tls: Option<Tls>

terminate: openmoat run’s proxy decrypts HTTPS to host with its own certificate authority and puts the value in there (ADR-043). Off unless set: without it an HTTPS request keeps the placeholder.

allow: Vec<String>

The only requests that may receive the value, METHOD /path each (Route). Empty: every request to host does. With rules, any other request to host that would get the value is refused before it is added. Needs tls: terminate or plain_http, where requests can be read.

Implementations

impl Secret

pub fn placeholder(&self) -> String

What the agent holds instead of the value: moat-secret:<id>:placeholder. Ids cannot contain :, so no placeholder occurs inside another.

pub fn plain_http_port(&self) -> u16

The port of the plain-HTTP requests the value goes into: port, or 80.

pub fn is_loopback(&self) -> bool

True when the host is this machine: localhost, a name under it, or 127.0.0.0/8. Hosts are validated lowercase DNS names or IPv4. The address type comes from core, which parses and does no I/O.

pub fn terminates(&self) -> bool

Whether openmoat run’s proxy decrypts HTTPS to the host (tls: terminate).

pub fn permit( &self, method: &str, target: &str, header_names: &[&str], ) -> Permit

What the allow rules say about a method request for target (the request line’s target) whose headers are named header_names. With rules, a request is refused when its path could be read as another (PathRefusal) or it asks for another method (METHOD_OVERRIDE_HEADERS, a _method query parameter). Reasons never quote the path: it may hold what the request is about.

Trait Implementations

impl Clone for Secret

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Secret

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Secret

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Secret

impl PartialEq for Secret

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Secret

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Secret