daemon

Documentation

Overview

Package daemon wires every bounded context into the vaultd process: socket listener, Noise handshakes, session issuance, request routing, and the restore/destroy lifecycle operations.

Index

• Constants
• type Server
  • func New(log *slog.Logger, store *sqlite.Store, dbPath string, ...) *Server
  • func (s *Server) DaemonStaticPublicKey() string
  • func (s *Server) Handle(ctx context.Context, st *connState, raw []byte) *protocol.Response
  • func (s *Server) OnDestroy(fn func())
  • func (s *Server) Serve(ctx context.Context, ln *net.UnixListener) error
  • func (s *Server) Vault() *vaultapp.Service

Constants

const ModeCLI = transport.ModeCLI

ModeCLI (transport.ModeCLI) is honored only on peer-credential-verified direct socket connections; vault-native refuses to relay it (PRD 12.3).

Types

type Server

type Server struct {
	// contains filtered or unexported fields
}

func New

func New(log *slog.Logger, store *sqlite.Store, dbPath string, staticKey flynnnoise.DHKey, kdf crypto.KDFParams) *Server

New assembles the full service graph over an opened, migrated store.

func (*Server) DaemonStaticPublicKey

func (s *Server) DaemonStaticPublicKey() string

DaemonStaticPublicKey exposes the transport identity for doctor output.

func (*Server) Handle

func (s *Server) Handle(ctx context.Context, st *connState, raw []byte) *protocol.Response

Handle dispatches one decrypted request envelope and returns the response envelope. It never returns internal error text to the client.

func (*Server) OnDestroy

func (s *Server) OnDestroy(fn func())

OnDestroy registers a callback fired after vault destruction (daemon exit).

func (*Server) Serve

func (s *Server) Serve(ctx context.Context, ln *net.UnixListener) error

Serve accepts connections until ctx is done.

func (*Server) Vault

func (s *Server) Vault() *vaultapp.Service

Vault exposes the vault service (used by vaultd main for shutdown locking).