wagoe.config.secrets — com.wagoe/wagoe-config 1.1.0-rc-1

The #secret Aero reader and the sources it resolves through.

#secret "DB_PASSWORD" ; the default source, :env unless configured #secret [:file "db-password"] ; a named source #secret {:name "DB_PASSWORD" :default "dev"} ; a default, for dev

A source is anything implementing ISecretSource. :env and :file are built in; declare more under :secret-sources in the config file, or pass them to wagoe.config/load-config. A secret no source has fails the read, naming the secret and never a value.

default-sources clj

(default-sources)

:env, and :file reading WAGOE_SECRETS_DIR, else /run/secrets — where Docker and Kubernetes mount secrets.

ISecretSource clj protocol

fetch-secret clj

(fetch-secret this secret-name)

The value of secret-name, or nil when this source does not have it.

redact clj

(redact x)

x with every value a #secret resolved to replaced by <secret source:name>, inside longer strings too: a DSN built with #join holds the password.

resolve-secret clj

(resolve-secret {:keys [secret-sources default-secret-source]
                 :or {default-secret-source :env}
                 :as opts}
                form)

The value of the secret form names. opts are Aero's: :secret-sources adds or replaces sources, :default-secret-source picks the one a bare name reads (default :env), and ::optional? makes a missing secret or source nil, for a reader that only wants the rest of the file. A form's :default is returned when the secret is missing or blank.

unredact clj

(unredact x)

The inverse of redact, for an edited copy written back.