lib.ec.secret_store.Vault: Add the store class #149

Merged

Jan Lindemann merged 1 commit from jan/feature/20261017-lib-ec-secret-store-vault-add-the-store-class into master 2026-10-17 14:27:35 +02:00 AGit

Conversation 0 Commits 1 Files changed 4 +744

Jan Lindemann commented 2026-10-17 14:16:04 +02:00

Owner

• Copy link
• Copy Markdown

lib.ec.secret_store.Vault: Add the store class

This commit adds the Vault store and the vault:// dispatch in FileContext.

A Vault KV v2 server maps nicely into jw-pkg's secret handling abstraction as just another secret store backend. Environment variables identify the storage details, analogous to the way it's handled in the SOPS backend.

• JW_SECRETS_VAULT_ADDR names the server, a unix socket address or an http URL; the standard VAULT_ADDR is never read; JW_SECRETS_VAULT_MOUNT the mount path, default secret; the token is the standard VAULT_TOKEN
• The transport is one curl per API call, through the Local context: a unix:// server is reached through its socket, an http:// server through its port
• A node's type is derived at stat time: an entry, a blob, a key below an entry, a branch if the path has children, otherwise a miss
• A blob's content is base64 under a single key of its KV secret, the marker being a path component, so a KV secret that is not a blob is always an entry

The test drives a dev server fixture from the workspace: stat/readdir/get on the fixture, the default fallback, the storage marker, and the copy forms - single key, whole entry, recursive entry, deploy to the on-host layout, and a host subtree.

#### lib.ec.secret_store.Vault: Add the store class This commit adds the Vault store and the vault:// dispatch in FileContext. A Vault KV v2 server maps nicely into `jw-pkg`'s secret handling abstraction as just another secret store backend. Environment variables identify the storage details, analogous to the way it's handled in the `SOPS` backend. - `JW_SECRETS_VAULT_ADDR` names the server, a unix socket address or an http URL; the standard `VAULT_ADDR` is never read; `JW_SECRETS_VAULT_MOUNT` the mount path, default secret; the token is the standard `VAULT_TOKEN` - The transport is one curl per API call, through the Local context: a unix:// server is reached through its socket, an http:// server through its port - A node's type is derived at stat time: an entry, a blob, a key below an entry, a branch if the path has children, otherwise a miss - A blob's content is base64 under a single key of its KV secret, the marker being a path component, so a KV secret that is not a blob is always an entry The test drives a dev server fixture from the workspace: stat/readdir/get on the fixture, the default fallback, the storage marker, and the copy forms - single key, whole entry, recursive entry, deploy to the on-host layout, and a host subtree.

Jan Lindemann added 1 commit 2026-10-17 14:16:04 +02:00

lib.ec.secret_store.Vault: Add the store class ... 8f87982490

This commit adds the Vault store and the vault:// dispatch in FileContext.

A Vault KV v2 server maps nicely into jw-pkg's secret handling abstraction
as just another secret store backend. Environment variables identify the
storage details, analogous to the way it's handled in the SOPS backend.

- JW_SECRETS_VAULT_ADDR names the server, a unix socket address or an http
  URL; the standard VAULT_ADDR is never read; JW_SECRETS_VAULT_MOUNT the
  mount path, default secret; the token is the standard VAULT_TOKEN
- The transport is one curl per API call, through the Local context: a
  unix:// server is reached through its socket, an http:// server through
  its port
- A node's type is derived at stat time: an entry, a blob, a key below an
  entry, a branch if the path has children, otherwise a miss
- A blob's content is base64 under a single key of its KV secret, the
  marker being a path component, so a KV secret that is not a blob is
  always an entry

The test drives a dev server fixture from the workspace: stat/readdir/get
on the fixture, the default fallback, the storage marker, and the copy
forms - single key, whole entry, recursive entry, deploy to the on-host
layout, and a host subtree.

Signed-off-by: Jan Lindemann <jan@janware.com>
Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v1.2.0

Jan Lindemann scheduled this pull request to auto merge when all checks succeed 2026-10-17 14:16:05 +02:00

Jan Lindemann merged commit 8f87982490 into master 2026-10-17 14:27:35 +02:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

janware/jw-pkg!149

No description provided.