waxseal

name	waxseal
description	Generator kinds, computed keys, template payloads, and Garage S3 credential patterns. Use when working on key creation, rotation, or template features.

WaxSeal Computed Keys & Generators

Generator Kinds

WaxSeal supports two generator kinds for producing secret material:

Kind	Output	Use case
randomBase64	URL-safe base64 string	Tokens, passwords, encryption keys
randomHex	Hex-encoded string	Garage S3 keys, hex-format secrets

Generator kind is stored in metadata at rotation.generator.kind and used by rotate to produce matching replacements.

Computed Keys (Two Types)

1. Derived (Cross-Reference)

Computed from other keys via inputs[] references. No GSM payload — value is calculated at reseal time.

source:
  kind: computed
computed:
  kind: template
  template: "postgresql://{{username}}:{{secret}}@{{host}}:{{port}}/{{database}}"
  inputs:
    - var: 
       {   }
      
       {  ,   }