Struct KeyManager 

pub struct KeyManager { /* private fields */ }

Manages encryption keys for secret storage.

The KeyManager handles key discovery, generation, and persistence with automatic fallback through multiple sources.

Example

use zlayer_secrets::KeyManager;

let manager = KeyManager::new();
let key = manager.get_or_create_key("production").unwrap();

Implementations

impl KeyManager

pub fn new() -> Self

Creates a new KeyManager with the default secrets directory.

The default directory is determined by zlayer_paths::ZLayerDirs::system_default().

pub fn with_base_dir(base_dir: impl AsRef<Path>) -> Self

Creates a new KeyManager with a custom base directory.

Arguments

• base_dir - Path to the directory for storing key files

pub fn get_or_create_key(&self, deployment: &str) -> Result<EncryptionKey>

Gets or creates an encryption key for the specified deployment.

Attempts to obtain a key through the following priority chain:

1. Environment key: If ZLAYER_SECRETS_KEY is set, decodes the hex-encoded 32-byte key directly.

2. Password derivation: If ZLAYER_SECRETS_PASSWORD is set, derives a key using Argon2id with the deployment name as salt.

3. File-based key: Loads the key from the deployment’s key file if it exists at {base_dir}/secrets_{deployment}.key.

4. Auto-generation: Generates a new random key and saves it to the key file with restricted permissions (0600 on Unix).

Arguments

• deployment - The deployment name used for key file naming and password salt derivation

Errors

Returns SecretsError::Encryption if:

• The hex-encoded key in ZLAYER_SECRETS_KEY is invalid
• Key file I/O operations fail
• Password derivation fails

Example

use zlayer_secrets::KeyManager;

let manager = KeyManager::new();

// First call: generates and saves key
let key = manager.get_or_create_key("production").unwrap();

// Subsequent calls: loads from file
let same_key = manager.get_or_create_key("production").unwrap();
assert_eq!(key.as_bytes(), same_key.as_bytes());

Trait Implementations

impl Clone for KeyManager

fn clone(&self) -> KeyManager

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyManager

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for KeyManager

fn default() -> Self

Returns the “default value” for a type.