Module secret 

Unified secret management — no plaintext credentials in deployed config.

All config fields that hold secrets use SecretRef, a serde-transparent newtype that encodes the resolution backend via a URI-like prefix:

Prefix	Backend
env:VAR	Environment variable
file:/path	File contents (trimmed)
prompt:Label	Interactive terminal input
keyring:name	Linux kernel keyring
systemd-creds:name	systemd LoadCredential=
(none)	Literal — logs a warning

Structs

ResolvedSecrets

All resolved secrets for the running instance. Never serialized to disk.

SecretRef

A reference to a secret in a config file.

SecretResolver

Resolves SecretRef values at startup and caches results in memory.

Enums

SecretBackend

Resolution backend for a single secret.

SecretError

Errors during secret resolution.