Module secret 

protected health-check header values and their keyed fingerprints Protected health-check header values and their keyed fingerprints.

A health-check header value is a credential more often than not (Authorization). It lives in memory only, in a SecretValue that is neither Clone, Serialize, Display nor value-revealing Debug, and whose buffer is zeroed when it drops. Anything that has to show or compare a value shows the header name plus a HeaderFingerprint: a keyed HMAC-SHA256 under a FingerprintKey the process generates for itself.

Zeroing on drop covers the buffer this module owns. It does not reach what the allocator, the kernel, a socket buffer or swap may already have copied.

Structs

ConfirmedBootstrap

The confirmed clusters a fresh worker is given and the version it stages them under: names and a number, never a value.

FingerprintKey

The process-local secret that keys HeaderFingerprints, with the public epoch that names it.

HeaderFingerprint

A keyed fingerprint of a header value: sozu-hc-hmac-sha256:v1:<epoch-32-hex>:<full-tag-64-hex>. The tag is the whole 256-bit HMAC, never truncated. The same name and value under one epoch give the same fingerprint, so equality is visible; without the key it reveals no plaintext.

HealthCheckHeaderValue

Protected ingress/IPC carrier of one health-check header value: the clear bytes travel in SetProtectedHealthCheck from the operator to the main process and are moved out into a SecretValue at once. It is the HealthCheckHeaderValue message of command.proto (name = 1, value = 2, both required) with a hand-written Message impl, mapped to the generated path by command/build.rs.

ProtectedHeader

One protected header: its public name, its public keyed fingerprint and a shared handle on the value. Cloning clones the Arc, never the bytes.

ProtectedHeaderJournal

The in-memory protected headers of every cluster, and the unresolved proposals that may still replace them.

ProtectedHeaderSet

An immutable, ordered set of ProtectedHeaders behind one Arc. Cloning clones that handle; the headers and their values are shared.

ProtectedHeaderVersion

Opaque identity of one proposal. It carries no header, so a task may persist it next to a cluster id; the set it names lives in memory only.

ProtectedHealthCheck

A validated protected health-check order: the cluster, its configuration with a trusted fingerprint on every header, and the held values.

ProtectedTransfer

The confirmed protected state of a main process, as a new main process takes it over: the optional fingerprint key, the number of versions issued, and the confirmed header set of every cluster, clusters sorted by id and headers in their configured order. Pending proposals never travel.

SecretValue

A health-check header value held in memory only.

VersionExhausted

Every ProtectedHeaderVersion has been issued.

Zeroizing

Zeroizing is a wrapper for any Z: Zeroize type which implements a Drop handler which zeroizes dropped values.

Enums

FingerprintParseError

Why a fingerprint string was refused. Static: it never echoes the input.

HeaderValueReadError

Why a header value could not be read from its source. Static: neither the bytes read nor any length of them appears in a diagnostic.

ProtectedHeaderChange

A full replacement of the protected headers of one cluster.

ProtectedHealthCheckError

Why a protected health-check order was refused. Static on purpose: neither a value, nor any length of one, appears in a diagnostic.

Resolution

What a resolution did.

SecretValueError

Why an ingress value was refused. Static on purpose: neither the value nor anything derived from it, its length included, appears in a diagnostic.

TransferError

Why the confirmed protected state could not be handed to a new main process, or an encoded hand-over was refused. Static on purpose: neither a value, nor the key, nor any length of one appears in a diagnostic.

Constants

PROTECTED_TRANSFER_MAX_BYTES

Largest encoded ProtectedTransfer a main upgrade may carry.

Traits

Zeroize

Trait for securely erasing values from memory.

Functions

read_header_value

Read one health-check header value from source (a file or stdin) into a protected ingress carrier.

refuse_to_deserialize

deserialize_with of the generated ingress value: it is never read back from a serialized form.

refuse_to_serialize

serialize_with of the generated ingress value: it is never serialized.