Full web : fichiers restants

internal/store/crypto.go

@@ -18,7 +18,7 @@ import (
 	"strings"
 )
 
-// Box encrypts the token secrets at rest (AES-256-GCM, random nonce, version byte).
+// Box encrypts the cluster passwords at rest (AES-256-GCM, random nonce, version byte).
 type Box struct{ aead cipher.AEAD }
 
 const boxVersion = 1
@@ -65,7 +65,7 @@ func (b *Box) Open(blob []byte) ([]byte, error) {
 	return plain, nil
 }
 
-// LoadKey returns the encryption key of the token secrets, in this order:
+// LoadKey returns the encryption key of the cluster passwords, in this order:
 // CONFSYNC_SECRET_KEY (64 hex characters or 44 base64 characters),
 // CONFSYNC_SECRET_KEY_FILE (same content, docker secret), or <dataDir>/secret.key,
 // created on first start. The last case keeps the key next to the database: fine for
@@ -96,7 +96,7 @@ func LoadKey(dataDir string) ([]byte, string, error) {
 	if err := os.WriteFile(path, []byte(hex.EncodeToString(k)+"\n"), 0o600); err != nil {
 		return nil, "", fmt.Errorf("cannot save the encryption key: %w", err)
 	}
-	log.Printf("encryption key created in %s: keep a copy, the token secrets cannot be read without it", path)
+	log.Printf("encryption key created in %s: keep a copy, the cluster passwords cannot be read without it", path)
 	return k, path, nil
 }
 
@@ -149,10 +149,3 @@ func CheckPassword(hash, pass string) bool {
 	got, err := pbkdf2.Key(sha256.New, pass, salt, iter, len(want))
 	return err == nil && subtle.ConstantTimeCompare(got, want) == 1
 }
-
-// RandomPassword returns a password for the first admin account.
-func RandomPassword() string {
-	b := make([]byte, 12)
-	_, _ = rand.Read(b)
-	return base64.RawURLEncoding.EncodeToString(b)
-}