infrastructure-secrets

Application-layer authenticated encryption for secrets at rest (AES-256-GCM). Master key held outside the database in an OS-protected file; sealed values carry nonce + key_id + algo_version for rotation. Decrypt once, hold plaintext only in process memory.

What it is for

Application-layer authenticated encryption for secrets at rest.

Why this exists (Gate 1.5 consensus, sprint-02): the ecosystem's prior at-rest secret mechanism was pgcrypto pgp_sym_encrypt with the master key held in a Postgres session GUC (app.encryption_key). Both consensus reviewers flagged that pattern for camera credentials: fragile on pooled connections, one leaked master key exposes every row, privileged SQL can invoke decrypt_credential, and rotation means re-encrypting every row. This crate moves the boundary into Rust:

• AES-256-GCM (AEAD) — confidentiality + integrity; tampering is detected.
• Master key outside the database, loaded from an OS-protected file (mode

0400/0600; group/other-readable keys are rejected). Callers may instead supply key bytes from a TPM-sealed blob or a systemd credential.

• Sealed values carry `key_id` + `algo_version` so keys can be rotated and

old ciphertext still decrypts. Store ciphertext/nonce as BYTEA, key_id as TEXT, algo_version as INT.

• Decrypt once in the consumer (e.g. a camera supervisor) and hold the

plaintext only in process memory — never persist a credential-bearing URL.

The key material and decrypted plaintext are zeroized on drop.

Capabilities

crate root

Application-layer authenticated encryption for secrets at rest.

Sealed

Application-layer authenticated encryption for secrets at rest.

SecretCipher

Application-layer authenticated encryption for secrets at rest.

SecretError

Application-layer authenticated encryption for secrets at rest.

How to use it

No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.

Module structure

No public modules: the crate root is its whole surface.

Public surface

`crate root`

No pub use re-exports: every item above is declared in this crate.

Boundary

Depends on no other workspace tier.

Shares tier infrastructure with 82 other crates: infrastructure-acquire, infrastructure-adapters-google-calendar, infrastructure-adapters-google-gmail, infrastructure-adapters-google-places, infrastructure-adapters-google-trends, infrastructure-adapters-shodan, infrastructure-adapters-yelp, infrastructure-agent, … (82 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Dependencies

Runtime, from outside the workspace.

Development. None.

Build. None.

Depended on by. 1 workspace crate.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  n_operations_camera_registry["operations-camera-registry"] -->|uses| SELF
  SELF["infrastructure-secrets"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Error model

Operational characteristics

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.

Related capabilities

1 workspace crate depends on this one: operations-camera-registry.

Verification

Evidence by module. How often each public module is named by something executable.

What the tests establish, by name:

• ciphertext_is_not_plaintext — src/lib.rs
• empty_and_large_plaintext_round_trip — src/lib.rs
• key_id_mismatch_is_reported — src/lib.rs
• nonces_are_unique_per_encryption — src/lib.rs
• parse_key_accepts_hex_with_newline — src/lib.rs
• parse_key_accepts_raw_32_bytes — src/lib.rs
• parse_key_rejects_non_hex_of_right_length — src/lib.rs
• parse_key_rejects_wrong_length — src/lib.rs
• round_trips_a_secret — src/lib.rs
• sealed_value_carries_key_id_and_algo — src/lib.rs
• tampered_ciphertext_fails_authentication — src/lib.rs
• tampered_nonce_fails_authentication — src/lib.rs
• unknown_algo_version_is_rejected — src/lib.rs
• wrong_key_cannot_decrypt — src/lib.rs

Documentation coverage

pie showData
    title Public items with rustdoc
    "Documented" : 13
    "No rustdoc detected" : 0

Metrics

pie showData
    title Public API by kind
    "constant" : 3
    "enum" : 1
    "method" : 7
    "struct" : 2

pie showData
    title Rust source composition
    "Code" : 283
    "Blank or comment" : 115

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.