{
  "module": "mesh-vault",
  "version": "1",
  "provides": [
    {
      "name": "secret",
      "scope": "mesh",
      "identity": {
        "in": "a vault entry"
      }
    }
  ],
  "emits": [
    "provisioned",
    "rotated",
    "secret-changed"
  ],
  "receives": {
    "secret": "${dir:grants}/mesh.json"
  },
  "grants": {
    "secret": "${dir:grants}"
  },
  "keeps": "/var/lib/mesh-vault/root",
  "data": {
    "own": [
      {
        "id": "state",
        "path": "${dir:state}",
        "class": "valuable",
        "why": "the vault's own keys"
      },
      {
        "id": "ledger",
        "path": "${dir:ledger}",
        "class": "valuable",
        "why": "every secret the vault keeps"
      },
      {
        "id": "root",
        "path": "${dir:root}",
        "class": "valuable",
        "why": "the vault's root material"
      },
      {
        "id": "store",
        "path": "${dir:store}",
        "class": "valuable",
        "why": "every secret the vault holds, sealed to its own key and to the operator key"
      }
    ],
    "consumers": {
      "secret": {
        "class": "valuable",
        "in": "ledger",
        "why": "a secret given to a consumer is kept nowhere else in the clear"
      }
    }
  },
  "resources": [
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
      "place": "."
    },
    {
      "id": "grants",
      "type": "directory",
      "mode": "0700"
    },
    {
      "id": "ledger",
      "type": "directory",
      "mode": "0700"
    },
    {
      "id": "root",
      "type": "directory",
      "mode": "0700"
    },
    {
      "id": "store",
      "type": "directory",
      "mode": "0700"
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "code",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/mesh-vault",
        "binary": "mesh-vault",
        "loads": [
          "mesh-vault"
        ],
        "env": {
          "MESH_RECEIVES": "${dir:grants}/mesh.json",
          "MESH_VAULT_LEDGER": "${dir:ledger}",
          "MESH_VAULT_ROOT": "${dir:root}",
          "MESH_VAULT_STORE": "${dir:store}",
          "MESH_VAULT_STATE": "${dir:state}"
        }
      }
    ]
  },
  "tools": [
    "secret_export",
    "secret_holders",
    "secret_verify",
    "secret_handed",
    "secret_vault_export",
    "provisioner_retirement",
    "provisioner_retire_approve",
    "provisioner_retire_reject",
    "provisioner_delete"
  ],
  "claims": [
    {
      "name": "mesh-vault",
      "scope": "mesh",
      "serves": [
        "get"
      ]
    }
  ]
}