LemonCore.
View Source
Master key resolution and initialization for encrypted secrets.
The key is looked up through a chain of LemonCore.Secrets.KeyProvider
modules. The default chain preserves the historical order:
- macOS Keychain entry (macOS only)
LEMON_SECRETS_MASTER_KEYenvironment variable~/.lemon/secrets_master_keyfile
Both the chain and the locations it looks at are configurable:
config :lemon_core, LemonCore.Secrets,
key_providers: [:env, :file],
key_file: "/etc/lemon/master_key",
env_var: "LEMON_SECRETS_MASTER_KEY"Key material
A master key is 32 random bytes, stored base64-encoded — exactly what
generate_encoded_key/0, mix lemon.secrets.init or openssl rand -base64 32
produce. Passphrase-like values are rejected with :weak_master_key because
they are used as key material verbatim, without password stretching. Setups
that already encrypted secrets under such a value can keep working by opting
in explicitly:
config :lemon_core, LemonCore.Secrets, allow_legacy_raw_keys: truewhich logs a deprecation warning on first use. Re-encrypting under a proper
key is the real fix; see the "Key rotation" section of LemonCore.Secrets.
Summary
Functions
Generates a master key and stores it with the first writable provider.
Types
@type source() :: atom()
Functions
@spec generate_encoded_key() :: String.t()
Generates a master key and stores it with the first writable provider.
On macOS that is the Keychain; elsewhere the keychain provider reports itself
unavailable and the key lands in the configured key file (0600). Pass
target: :file (or any provider name) to force one, and force: true to
replace an existing key file — note that doing so makes every secret already
encrypted under the old key unreadable.