rc

Documentation

Index

• func Cleanup()
• func Update(mutate func(c *Config) error) error
• type Config
  • func Apply(use string) (Config, error)
  • func Read() (Config, error)
  • func (c *Config) Alias(name string) (string, bool, error)
  • func (c *Config) Apply(use string) error
  • func (c *Config) CACerts() []string
  • func (c *Config) Find(alias string) (*Vault, bool, error)
  • func (c *Config) HasStrongbox() bool
  • func (c *Config) Namespace() string
  • func (c *Config) SetCurrent(name string, reskip bool) error
  • func (c *Config) SetTarget(alias string, config Vault) error
  • func (c *Config) SetToken(token string) error
  • func (c *Config) SetTokenFor(alias, token string) error
  • func (c *Config) URL() string
  • func (c *Config) Vault(which string) (*Vault, error)
  • func (c *Config) Verified() bool
• type Env
  • func SnapshotEnv() Env
  • func (e Env) Restore()
• type Options
• type Vault
  • func (v *Vault) UnmarshalYAML(unmarshal func(any) error) error

Functions

func Cleanup

func Cleanup()

Cleanup will clean up any temporary files that the rc package may have made. Cleanup is thread-safe and can be called multiple times.

func Update

func Update(mutate func(c *Config) error) error

Update applies a single mutation to the persisted configuration. It takes the config write lock, reads the current on-disk state, invokes mutate on it, writes the result atomically, and releases the lock.

Reading under the lock, immediately before mutating, is what makes a concurrent writer's delta survive: each mutation lands on the latest file, not on whatever this process read at startup. Keep mutate to the mutation itself -- the lock is held for its duration, so no prompts, no network I/O, nothing slower than the file writes it protects.

Types

type Config

type Config struct {
	Version int               `yaml:"version"`
	Current string            `yaml:"current"`
	Vaults  map[string]*Vault `yaml:"vaults"`
	Options Options           `yaml:"options"`
}

func Apply

func Apply(use string) (Config, error)

func Read

func Read() (Config, error)

func (*Config) Alias

func (c *Config) Alias(name string) (string, bool, error)

Alias resolves a name -- either an alias or the URL of a target -- to the alias that target is stored under. Callers that change the config need the key rather than the target it points at, and a name reaches the same target here as it does everywhere else.

func (*Config) Apply

func (c *Config) Apply(use string) error

func (*Config) CACerts

func (c *Config) CACerts() []string

func (*Config) Find

func (c *Config) Find(alias string) (*Vault, bool, error)

func (*Config) HasStrongbox

func (c *Config) HasStrongbox() bool

func (*Config) Namespace

func (c *Config) Namespace() string

func (*Config) SetCurrent

func (c *Config) SetCurrent(name string, reskip bool) error

SetCurrent selects the target named by either its alias or its URL. What it records is the alias, because that is the name the rest of the config is keyed by: a URL stored here resolves only for as long as exactly one target still carries it, so deleting that target leaves a selection that names nothing and every later command reporting a missing current target.

func (*Config) SetTarget

func (c *Config) SetTarget(alias string, config Vault) error

func (*Config) SetToken

func (c *Config) SetToken(token string) error

func (*Config) SetTokenFor

func (c *Config) SetTokenFor(alias, token string) error

SetTokenFor stores a token against a named target without making it the current one. Commands that honour -T need that separation: -T names a Vault for one command, and moving the current target would outlive the command, since Write persists it.

func (*Config) URL

func (c *Config) URL() string

func (*Config) Vault

func (c *Config) Vault(which string) (*Vault, error)

func (*Config) Verified

func (c *Config) Verified() bool

type Env

type Env []envVar

Env is what the environment held before a target was applied to it.

func SnapshotEnv

func SnapshotEnv() Env

SnapshotEnv records the variables Apply sets, so that a caller applying more than one target can put the environment back between them. Without it the second target inherits everything the first one carried and it does not -- skipped verification, a CA bundle, a namespace -- and is talked to on terms that are not its own.

func (Env) Restore

func (e Env) Restore()

Restore returns the environment to what it held when it was recorded.

type Options

type Options struct {
	ManageVaultToken bool `yaml:"manage_vault_token"`
}

type Vault

type Vault struct {
	URL        string   `yaml:"url"`
	Token      string   `yaml:"token"`
	CACerts    []string `yaml:"ca_certs,omitempty"`
	SkipVerify bool     `yaml:"skip_verify,omitempty"`

	// Strongbox opts a target into the Strongbox seal-state service on port
	// :8484. Older configs wrote a no_strongbox key instead, with the
	// opposite default: Strongbox was on unless no_strongbox: true.
	// UnmarshalYAML honors that key when the file has it, so an upgrade
	// does not silently disarm Strongbox for every pre-existing target; a
	// file with neither key gets the new opt-in default (false).
	Strongbox bool   `yaml:"strongbox,omitempty"`
	Namespace string `yaml:"namespace,omitempty"`
}

func (*Vault) UnmarshalYAML

func (v *Vault) UnmarshalYAML(unmarshal func(any) error) error

UnmarshalYAML translates the legacy no_strongbox key into Strongbox when the key is present in the document, and leaves Strongbox at its zero value (the new opt-in default) when it is not. Marshal only ever writes the strongbox key, so the translated intent -- not the legacy key -- is what a subsequent write persists.