config

Documentation

Index

• Constants
• Variables
• func ApplyRenameRules(filename string, rules []string) (string, error)
• func FindConfigFromPath(startDir string) (string, error)
• func ParseRenameRule(rule string) (*regexp.Regexp, string, error)
• type ConfcryptSection
• type Config
  • func Load(configPath string) (*Config, error)
  • func (c *Config) AddFilePattern(pattern string)
  • func (c *Config) ClearSecrets()
  • func (c *Config) ConfigDir() string
  • func (c *Config) ConfigPath() string
  • func (c *Config) FindRecipientByKey(pubKey string) *RecipientConfig
  • func (c *Config) GetDecryptRename(filePath string) (string, error)
  • func (c *Config) GetEncryptRename(filePath string) (string, error)
  • func (c *Config) GetMAC(filePath string) (string, bool)
  • func (c *Config) GetMatchingFiles() ([]string, error)
  • func (c *Config) GetMatchingFilesWithFormat() ([]MatchedFile, error)
  • func (c *Config) GetRecipients() ([]age.Recipient, error)
  • func (c *Config) GetSecretForRecipient(pubKey string) (string, bool)
  • func (c *Config) HasSecrets() bool
  • func (c *Config) MatchesFile(absFilePath string) (bool, error)
  • func (c *Config) MatchesFileWithFormat(absFilePath string) (string, bool, error)
  • func (c *Config) RemoveMAC(filePath string)
  • func (c *Config) Save() error
  • func (c *Config) SetMAC(filePath, mac string)
  • func (c *Config) SetSecrets(secrets map[string]string)
• type FilePattern
  • func ParseFilePattern(pattern string) FilePattern
• type KeyRule
  • func ParseKeyRules(rules []interface{}) ([]KeyRule, error)
• type MatchedFile
• type RecipientConfig
  • func (r *RecipientConfig) GetKeyType() crypto.KeyType
  • func (r *RecipientConfig) GetPublicKey() string
• type RenameFilesConfig
• type SecretEntry

Constants

const DefaultConfigName = ".confcrypt.yml"

Variables

var Version = "1.0.0" // Set by main package at startup

Version is the current tool/config format version

Functions

func ApplyRenameRules

func ApplyRenameRules(filename string, rules []string) (string, error)

ApplyRenameRules applies a list of rename rules to a filename Returns the renamed filename (rules are applied in order, first match wins)

func FindConfigFromPath

func FindConfigFromPath(startDir string) (string, error)

FindConfigFromPath searches for .confcrypt.yml starting from startDir and walking upward

func ParseRenameRule

func ParseRenameRule(rule string) (*regexp.Regexp, string, error)

ParseRenameRule parses a rename rule in /pattern/replacement/ format Returns the compiled regex and replacement string

Types

type ConfcryptSection

type ConfcryptSection struct {
	Version   string            `yaml:"version"`
	UpdatedAt string            `yaml:"updated_at"`
	Store     []SecretEntry     `yaml:"store"`
	MACs      map[string]string `yaml:"macs,omitempty"` // file path -> encrypted MAC
}

ConfcryptSection represents the .confcrypt metadata section

type Config

type Config struct {
	Recipients   []RecipientConfig  `yaml:"recipients"`
	Files        []string           `yaml:"files"`
	FilesExclude []string           `yaml:"files_exclude,omitempty"`
	RenameFiles  *RenameFilesConfig `yaml:"rename_files,omitempty"`
	FilesRename  *RenameFilesConfig `yaml:"files_rename,omitempty"`
	KeysInclude  []interface{}      `yaml:"keys_include"` // Can be string or KeyRule
	KeysExclude  []interface{}      `yaml:"keys_exclude"` // Can be string or KeyRule
	Confcrypt    *ConfcryptSection  `yaml:".confcrypt,omitempty"`
	// contains filtered or unexported fields
}

Config represents the .confcrypt.yml configuration file

func Load

func Load(configPath string) (*Config, error)

Load loads the configuration from the specified path or searches for it

func (*Config) AddFilePattern

func (c *Config) AddFilePattern(pattern string)

AddFilePattern adds a file pattern to the config's files list

func (*Config) ClearSecrets

func (c *Config) ClearSecrets()

ClearSecrets removes all encrypted secrets from the store. This triggers a fresh AES key generation on the next encryption.

func (*Config) ConfigDir

func (c *Config) ConfigDir() string

ConfigDir returns the directory containing the config file

func (*Config) ConfigPath

func (c *Config) ConfigPath() string

ConfigPath returns the path to the config file

func (*Config) FindRecipientByKey

func (c *Config) FindRecipientByKey(pubKey string) *RecipientConfig

FindRecipientByKey finds a recipient config by their public key (age, ssh, yubikey, or fido2)

func (*Config) GetDecryptRename

func (c *Config) GetDecryptRename(filePath string) (string, error)

GetDecryptRename returns the renamed path for decryption Applies rename_files.decrypt rules to the filename (basename only)

func (*Config) GetEncryptRename

func (c *Config) GetEncryptRename(filePath string) (string, error)

GetEncryptRename returns the renamed path for encryption Applies rename_files.encrypt rules to the filename (basename only)

func (*Config) GetMAC

func (c *Config) GetMAC(filePath string) (string, bool)

GetMAC returns the MAC for a specific file

func (*Config) GetMatchingFiles

func (c *Config) GetMatchingFiles() ([]string, error)

GetMatchingFiles returns all files matching the configured patterns

func (*Config) GetMatchingFilesWithFormat

func (c *Config) GetMatchingFilesWithFormat() ([]MatchedFile, error)

GetMatchingFilesWithFormat returns all files matching the configured patterns with format info If a file matches multiple patterns, explicit format overrides (e.g., :full) take precedence

func (*Config) GetRecipients

func (c *Config) GetRecipients() ([]age.Recipient, error)

GetRecipients returns parsed recipients (age or SSH keys)

func (*Config) GetSecretForRecipient

func (c *Config) GetSecretForRecipient(pubKey string) (string, bool)

GetSecretForRecipient returns the encrypted secret for a specific recipient

func (*Config) HasSecrets

func (c *Config) HasSecrets() bool

HasSecrets returns true if there are encrypted secrets stored

func (*Config) MatchesFile

func (c *Config) MatchesFile(absFilePath string) (bool, error)

MatchesFile checks if the given absolute file path matches any of the configured file patterns

func (*Config) MatchesFileWithFormat

func (c *Config) MatchesFileWithFormat(absFilePath string) (string, bool, error)

MatchesFileWithFormat checks if the given absolute file path matches any of the configured file patterns Returns the format override (if any) and whether the file matched If multiple patterns match, explicit format overrides take precedence

func (*Config) RemoveMAC

func (c *Config) RemoveMAC(filePath string)

RemoveMAC removes the MAC for a specific file

func (*Config) Save

func (c *Config) Save() error

Save writes the config back to disk, preserving comments

func (*Config) SetMAC

func (c *Config) SetMAC(filePath, mac string)

SetMAC sets the MAC for a specific file

func (*Config) SetSecrets

func (c *Config) SetSecrets(secrets map[string]string)

SetSecrets updates the encrypted secrets for all recipients

type FilePattern

type FilePattern struct {
	Pattern string // The glob pattern (e.g., "*.yml", "*.txt")
	Format  string // Optional format override: "", "full", "yaml", "json", "env"
}

FilePattern represents a file pattern with optional format override

func ParseFilePattern

func ParseFilePattern(pattern string) FilePattern

ParseFilePattern parses a file pattern string that may include a format override Format: "pattern" or "pattern:format" (e.g., "*.txt:full", "*.yml:json")

type KeyRule

type KeyRule struct {
	Key     string `yaml:"key"`
	Type    string `yaml:"type"`              // "exact", "regex", "path"
	Options string `yaml:"options,omitempty"` // "-i" for case-sensitive regex (default is case-insensitive)
}

KeyRule represents an explicit key matching rule

func ParseKeyRules

func ParseKeyRules(rules []interface{}) ([]KeyRule, error)

ParseKeyRules parses the keys_include or keys_exclude into KeyRule structs

type MatchedFile

type MatchedFile struct {
	Path   string // Absolute path to the file
	Format string // Format override from the pattern ("", "full", "yaml", "json", "env")
}

MatchedFile represents a file that matched a pattern, along with its format override

type RecipientConfig

type RecipientConfig struct {
	Name    string `yaml:"name,omitempty"`
	Age     string `yaml:"age,omitempty"`     // Native age X25519 public key
	SSH     string `yaml:"ssh,omitempty"`     // SSH public key (ed25519, RSA)
	YubiKey string `yaml:"yubikey,omitempty"` // YubiKey-derived age key (age1yubikey1...)
	FIDO2   string `yaml:"fido2,omitempty"`   // FIDO2-derived age key (age1fido21...)
}

RecipientConfig represents a recipient in the config

func (*RecipientConfig) GetKeyType

func (r *RecipientConfig) GetKeyType() crypto.KeyType

GetKeyType returns the type of key configured for this recipient

func (*RecipientConfig) GetPublicKey

func (r *RecipientConfig) GetPublicKey() string

GetPublicKey returns the public key from either Age, YubiKey, FIDO2, or SSH field

type RenameFilesConfig

type RenameFilesConfig struct {
	Encrypt []string `yaml:"encrypt,omitempty"`
	Decrypt []string `yaml:"decrypt,omitempty"`
}

RenameFilesConfig represents file renaming rules for encrypt/decrypt

type SecretEntry

type SecretEntry struct {
	Recipient string `yaml:"recipient"`
	Secret    string `yaml:"secret"`
}

SecretEntry represents an encrypted secret for a recipient