Skip to main content

Secrets Management

Beyond plain .env values, Regius can fetch secrets from external providers at load time and encrypt sensitive values at rest.

Secret References​

Use secret://{provider}/{path} references in config values to fetch secrets from external providers. Built-in providers:

  • env — environment variables (for development)
  • aws — AWS Secrets Manager
  • vault — HashiCorp Vault via REST API

Enable with SECRETS_PROVIDER=env,aws,vault and app.SetupSecrets().

# config.yaml with secret references
database:
  pass: secret://aws/myapp/db-password
redis:
  password: secret://vault/secret/data/myapp/redis
api_token: secret://env/API_TOKEN
// Enable secrets resolution before calling app.New()
// Set SECRETS_PROVIDER=env,aws,vault in .env or OS env
resolver, err := app.SetupSecrets()
if err != nil {
    log.Fatal(err)
}
// Now call app.New() - secret:// references are resolved automatically
# Environment variables for secrets providers
SECRETS_PROVIDER=env,aws,vault
AWS_REGION=us-east-1
VAULT_ADDR=http://vault:8200
VAULT_TOKEN=s.hbr3xxx

Encrypted Values​

Wrap sensitive values in ENC(...) to encrypt them at rest. Decryption uses AES-CFB with the CONFIG_ENCRYPTION_KEY env var (32 bytes, raw or base64). Use config.EncryptValue() to generate encrypted values. Compatible with the framework's Encryption type.

// Generate an encrypted value (run once, store the result in config)
key := []byte("01234567890123456789012345678901") // 32 bytes
encrypted, _ := config.EncryptValue("my_secret_password", key)
fmt.Println(encrypted) // ENC(Vx4nK9...==)
# config.yaml with encrypted value
database:
  pass: ENC(Vx4nK9mJb2Q...==)
# Set the decryption key (32 bytes, raw or base64-encoded)
CONFIG_ENCRYPTION_KEY=01234567890123456789012345678901