Module secrets 

Available on crate feature secrets only.

Secret-reference resolution for HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault — no vendor SDK for any of the three, matching this crate’s existing storage-s3/storage-azure/sso modules.

JWT signing keys, DB credentials, and TLS keys are ordinarily just plain RWS_CONFIG_*/application env vars. resolve lets any of those values instead be a reference to a secret held in a managed secrets store:

Prefix	Backend	Example
vault://path#field	HashiCorp Vault (KV v2)	vault://secret/myapp/db#password
aws-sm://name or aws-sm://name#field	AWS Secrets Manager	aws-sm://prod/db-password
azkv://vault-name/secret-name	Azure Key Vault	azkv://my-kv/db-password

A value that doesn’t start with one of these prefixes is returned unchanged — resolution is purely additive, not a new required step for every existing plain-value config var.

Example

use rust_web_server::secrets;

// VAULT_ADDR / VAULT_TOKEN (Vault), AWS_REGION + credentials (Secrets
// Manager), or AZURE_KEY_VAULT_TENANT_ID + co. (Key Vault) must already
// be set in the environment for the corresponding prefix to resolve.
let db_password = secrets::resolve("vault://secret/myapp/db#password")?;

Automatic env var resolution

resolve_env_vars scans every currently-set RWS_-prefixed environment variable and rewrites in place (via std::env::set_var) any whose value matches one of the prefixes above. Server::setup() calls this automatically (right after entry_point::bootstrap(), so it sees the fully layered config) once this feature is enabled, so any RWS_CONFIG_* value — RWS_CONFIG_TLS_KEY_FILE, a config-driven proxy’s token_env-referenced variable, anything — can be a secret reference with no code changes, matching the “additive to every existing RWS_CONFIG_*/RWS_* env var” goal this feature was built for.

Failure mode: fail fast, not fail open

A value that looks like a secret reference but fails to resolve (wrong token, unreachable backend, missing field, …) is a startup error, not a silently-ignored one — the alternative would be a server starting up with a JWT signing key or DB password literally equal to the string "vault://secret/myapp/db#password", which is worse than refusing to start at all.

Structs

SecretsError

Error resolving a secret reference — a network failure, an authentication failure, a missing field, or a malformed reference.

Functions

resolve

Resolves value if it starts with a recognized secret-reference prefix (vault://, aws-sm://, azkv://); otherwise returns it unchanged.

resolve_env_vars

Scans every environment variable whose name starts with RWS_ and rewrites in place (via std::env::set_var) any whose value matches a recognized secret-reference prefix. Variables that don’t match are left untouched — this only ever narrows down to the ones that opted in by using one of the prefixes.