Struct StorageEncryption 

pub struct StorageEncryption {
    pub kek: Option<EncryptionKey>,
    pub source_id: String,
}

Encryption configuration for opening a DurableStorage.

disabled() (the default for the legacy open variants) keeps the database plaintext and byte-compatible with pre-encryption binaries. with_kek() supplies the Key-Encryption-Key — the operator secret that wraps a per-database data key; it is never used verbatim as the cipher key (see crate::keyring). A wrong/missing KEK for an encrypted database fails closed at open (the DB will refuse to open, never silently read as plaintext).

Fields

kek: Option<EncryptionKey>

The KEK. None ⇒ plaintext database.

source_id: String

Human-readable identifier for the key source (e.g. “env:SOCHDB_ENCRYPTION_KEY”, “embedded”, “kms:…”). Bound into the keyring for provenance.

Implementations

impl StorageEncryption

pub fn disabled() -> Self

Plaintext (no encryption) — the default.

pub fn with_kek(kek: EncryptionKey, source_id: impl Into<String>) -> Self

Encrypt at rest under the given KEK.

pub fn is_enabled(&self) -> bool

Whether a key is configured (i.e. encryption is requested).