No description
- Go 93.3%
- Makefile 5.1%
- Dockerfile 1.6%
6ae78b13f9* chore(deps): bump actions/setup-go to v7 Self-hosted CI workflows. * ci: setup-go v7 + cache false |
||
|---|---|---|
| .github | ||
| cmd/module | ||
| deploy | ||
| internal | ||
| test | ||
| .dockerignore | ||
| .env.example | ||
| .gitignore | ||
| .golangci.yml | ||
| CHANGELOG.md | ||
| COMPATIBILITY.md | ||
| CONTRIBUTING.md | ||
| Dockerfile | ||
| go.mod | ||
| go.sum | ||
| LICENSE | ||
| Makefile | ||
| muxcore.json | ||
| README.md | ||
| SECURITY.md | ||
Secrets File Vault
AES-256-GCM encrypted file-backed secrets vault for MuxCore.
A MuxCore sidecar module that stores secrets in a local JSON file, encrypting each value with AES-256-GCM under a 32-byte master key. Provides the secrets capability via gRPC (Get / Set / Delete / List).
How It Works
Module request ──→ secrets-file (gRPC) ──→ AES-256-GCM vault ──→ secrets.json
Each secret is stored as {"n": <nonce>, "d": <ciphertext>}. The master key never leaves the process; values are decrypted only on Get.
Configuration
| Variable | Default | Description |
|---|---|---|
SECRETS_MASTER_KEY |
`` | Hex-encoded 32-byte master key (takes precedence) |
SECRETS_KEY_FILE |
`` | Path to hex-encoded master key file (auto-created if missing) |
SECRETS_STORE |
secrets.json |
Encrypted secrets store path |
SECRETS_GRPC_ADDR |
:9550 |
gRPC listen address |
Quick Start
go build -o secrets-file ./cmd/module
export MUXCORE_INSECURE_DISABLE_TLS=true
export SECRETS_MASTER_KEY="$(openssl rand -hex 32)"
./secrets-file --muxcore-mesh-addr localhost:9090
Capability
secrets — Encrypted secrets storage
License
GPL-3.0