Skip to main content

filesystem Vault

Vault

filesystem Vault

Defines a vault stored on the local filesystem.

The filesystem vault uses PKCS12 format to store signed certificates and keys.

The keys option is used to identify the local peer in a TLS handshake.

The trust option is used to verify identity of the remote peer in a TLS handshake.

The signers option is used to challenge for mutual authentication in a TLS handshake.

The secrets option is used to encrypt and decrypt values with a symmetric key.

The revocation option is used to specify the certificate revocation method.

server:
  type: filesystem
  options:
    keys:
      store: localhost.p12
      type: pkcs12
      password: ${{env.KEYS_PASSWORD}}
    revocation: crl

Configuration (* required)

options

object

The filesystem specific options.

options:
  keys:
    store: localhost.p12
    type: pkcs12
    password: ${{env.KEYS_PASSWORD}}

options.keys

object

Private keys.

keys.store

string

Relative path to keystore.

keys.type

string | Default: pkcs12

Keystore type.

keys.password

string

Keystore password.

keys.entries

array of string

Aliases of the keystore entries to use. If not provided, all key entries in the keystore are used.

options.trust

object

Trust certificates.

trust.store

string

Relative path to keystore.

trust.type

string | Default: pkcs12

Keystore type.

trust.password

string

Keystore password.

trust.entries

array of string

Aliases of the keystore entries to use. If not provided, all trusted certificate entries in the keystore are used.

options.signers

object

Signer certificates.

signers.store

string

Relative path to keystore.

signers.type

string | Default: pkcs12

Keystore type.

signers.password

string

Keystore password.

signers.entries

array of string

Aliases of the keystore entries to use. If not provided, all trusted certificate entries in the keystore are used.

options.secrets

object

Symmetric encryption keys, backed by SecretKeyEntry aliases in the keystore. Unlike keys/trust/signers, entries is name-keyed so a secret's logical name can differ from its keystore alias, and each entry can optionally carry a version history for key rotation.

options:
  secrets:
    store: dev-secrets.p12
    entries:
      app-key: app-key-alias
      session-key:
        active: "2"
        versions:
          "1": session-key-v1-alias
          "2": session-key-v2-alias

secrets.store

string

Relative path to keystore.

secrets.type

string | Default: pkcs12

Keystore type.

secrets.password

string

Keystore password.

secrets.entries

object as map of named string or object properties

Named secret entries. Each entry is either a plain string (the keystore alias, implicitly version 1) or an object with active/versions for key rotation.

entries.active*

string | Pattern: ^[0-9]+$

The version number currently used to encrypt new values. Required when the entry is an object rather than a plain string.

entries.versions*

object as map of named string properties

Map of version number to keystore alias. Decryption resolves whichever version produced a given ciphertext, regardless of which version is currently active. Required when the entry is an object rather than a plain string.

entries.algorithm

enum [ AES128_GCM, AES256_GCM ]

Encryption algorithm used for this entry.

options.revocation

enum [ crl ]

Certificate revocation method.

Gateway Version