module

CRE::Cli::Bootstrap

Constants

HMAC_KEY_VAR = "CRE_HMAC_KEY_HEX"
KEK_HEX_VAR = "CRE_KEK_HEX"
KEK_VERSION_VAR = "CRE_KEK_VERSION"
SEAL_INTERVAL_VAR = "CRE_SEAL_INTERVAL_SECONDS"
SIGNING_KEY_VAR = "CRE_SIGNING_KEY_HEX"

Class methods

build_persistence(url : String) : Persistence::Persistence
Source
envelope

Returns an Envelope when CRE_KEK_HEX is set; nil otherwise. nil disables at-rest encryption — appropriate for the demo path, but cre run/watch should refuse to start without it.

Source
redact_db_url(url : String) : String
Source
register_rotators(worker : Engine::RotationWorker, io : IO) : Nil
Source
require_envelope
Source
require_hmac_key

Loads the 32-byte HMAC seed key from CRE_HMAC_KEY_HEX. Hard-fails when missing; the prior all-zero default left audit logs trivially forgeable by anyone with read access to the source.

Source
seal_interval
Source
signer

Returns an Ed25519 signer when CRE_SIGNING_KEY_HEX is set, nil otherwise. When nil, batch sealing is disabled and 'cre audit verify' will skip the Merkle layer.

Source

Nested types