Load the master key from the configured key file.
(&mut self)
| 134 | |
| 135 | /// Load the master key from the configured key file. |
| 136 | pub fn load_master_key(&mut self) -> crate::Result<()> { |
| 137 | let path = |
| 138 | self.config |
| 139 | .master_key_path |
| 140 | .as_ref() |
| 141 | .ok_or_else(|| crate::Error::Encryption { |
| 142 | detail: "no master key path configured".into(), |
| 143 | })?; |
| 144 | |
| 145 | check_key_file(path)?; |
| 146 | |
| 147 | let key_bytes = std::fs::read(path).map_err(|e| crate::Error::Encryption { |
| 148 | detail: format!("failed to read master key from {}: {e}", path.display()), |
| 149 | })?; |
| 150 | |
| 151 | if key_bytes.len() < 32 { |
| 152 | return Err(crate::Error::Encryption { |
| 153 | detail: format!("master key too short: {} bytes (need 32)", key_bytes.len()), |
| 154 | }); |
| 155 | } |
| 156 | |
| 157 | let mut key = Zeroizing::new([0u8; 32]); |
| 158 | key.copy_from_slice(&key_bytes[..32]); |
| 159 | self.master_key = Some(*key); |
| 160 | |
| 161 | info!(path = %path.display(), "master encryption key loaded"); |
| 162 | Ok(()) |
| 163 | } |
| 164 | |
| 165 | /// Whether encryption is active (enabled + key loaded). |
| 166 | pub fn is_active(&self) -> bool { |