# `Macaw.Host.Secrets`
[🔗](https://github.com/dcoai/macaw_host/blob/v0.1.4/lib/macaw/host/secrets.ex#L1)

Secrets the system generates itself (`secret_key_base`, signing and
sealing keys), kept in the data directory, readable by their owner only.

A host never holds a secret it must not lose: the app generates it on
first boot, and it travels with the data. An explicit env var still wins,
in the app's own configuration.

- **Generated once**, 64 random bytes by default, base64.
- **Written atomically:** a temporary file, mode 0600, then a rename, so
  a crash leaves no partial secret and no window where the file is
  readable by others.
- **Checked on every read:** a file readable by group or others raises,
  naming the file and its mode, rather than using a secret that may have
  leaked.
- **Restorable:** `put!/3` writes a given secret, for a restore from
  backup.

# `ensure!`

```elixir
@spec ensure!(Path.t(), String.t(), pos_integer()) :: String.t()
```

The secret stored at `data_dir/name`, generating `bytes` random bytes
(base64) on first use.

# `put!`

```elixir
@spec put!(Path.t(), String.t(), String.t()) :: :ok
```

Writes a known secret (a restore from backup), the same way a generated one is written.

---

*Consult [api-reference.md](api-reference.md) for complete listing*