secret

This package allows simple "encoding" of secret values in configuration files:

user: hans
pass: env:USERPASS

The secret value consists of a schema, and one or more values. Currently supported schemes are:

• plain, pass: the value itself is the secret, with whitespace trimmed
• raw: the value itself is the secret
• env: the actual value is taken literally from the referenced environment variable. The variable is unset after first access.
• file: the actual value is taken from the referenced file, with whitespace trimmed. The file must have 0600 or 0400 permissions.
• rawfile: as file, but literally
• netrc: the value is read from a ~/.netrc file (override via $NETRC_FILE). Format: netrc:[<login>@]<machine>[/<field>] where field is one of password (default), login, or account.
• password-store: the first line of an entry read with pass show, with trailing whitespace removed. Leading whitespace is preserved. Format: password-store:<entry>.

Autodetection of schema is attempted for absolute path names (as file) and for environment variables (prefix $).

Fallback

Multiple specs can be chained with || — candidates are tried left-to-right, the first success wins:

pass: env:SECRET_TOKEN||file:/run/secrets/token||plain:default

Whitespace around || is allowed:

pass: env:TOKEN || file:/run/secrets/token || plain:default

Quoting

Values may be quoted with single or double quotes (identical behavior) to protect literal || or surrounding whitespace:

pass: plain:"has || inside"||env:FALLBACK
pass: file:'/path with spaces/secret'
pass: raw:" preserve leading/trailing spaces "

Quotes wrap only the value, not the scheme prefix.

Redacting for logs

Use Redact to obtain a version of a spec safe to print or log. It masks the value for schemes that carry the secret literally (plain, pass, raw) and leaves known reference-only schemes (env, file, rawfile, netrc, password-store) unchanged, since those name a location, not the secret itself. Unknown and malformed schemes are masked so redaction fails closed:

secret.Redact("plain:hunter2")           // "plain:***"
secret.Redact("env:JOKER_TOKEN")          // "env:JOKER_TOKEN"
secret.Redact("unknown:hunter2")           // "unknown:***"
secret.Redact("env:TOKEN||plain:default")  // "env:TOKEN||plain:***"