rustlavel_vault/lib.rs
1//! rustlavel-vault: secrets from OpenBao or HashiCorp Vault.
2//!
3//! One package for both. OpenBao is a fork of Vault from before the licence
4//! changed to BUSL, and the HTTP API is the same one — nothing here compiles
5//! against either project, so neither licence reaches your binary.
6//!
7//! The point is to stop a database password living in `.env`. A file on disk
8//! is a file that gets copied into a backup, a container image, a screenshot
9//! and eventually a repository. A secret fetched at boot lives in memory, and a
10//! *dynamic* one — an account the store creates for this process and deletes
11//! when the lease ends — cannot be replayed from a leaked backup at all.
12//!
13//! Written from scratch on the published HTTP API, over `rustlavel-client`.
14
15pub mod auth;
16pub mod client;
17pub mod database;
18pub mod error;
19pub mod fake;
20pub mod kv;
21pub mod lease;
22pub mod leases;
23pub mod plugin;
24pub mod renew;
25pub mod resolve;
26
27pub use auth::{AppRole, Kubernetes, Login, Token, UserPass};
28pub use client::{VaultClient, VaultResponse};
29pub use database::{DatabaseCredentials, DatabaseSecrets};
30pub use kv::{Kv, Secret as KvSecret, SecretMetadata};
31pub use error::VaultError;
32pub use fake::{Fake, FakeVault};
33pub use lease::Lease;
34pub use plugin::Vault;
35pub use renew::Renewer;
36pub use resolve::{Resolver, Secret, SecretRef, SecretSource};
37
38pub use rustlavel_core::{Error, Result};