# john361/vault-secrets architecture

> Architecture diagram of the GitHub repository john361/vault-secrets, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/john361/vault-secrets
- Repository: https://github.com/john361/vault-secrets

## Overview

Vault Secrets is a Rust CLI for retrieving Vault secrets and creating or restoring encrypted backups. The main workflow parses a command and loads configuration, then dispatches to find, export, or import operations. Find retrieves a selected secret for script use; export traverses configured mounts and writes encrypted backup files; import decrypts backup files and restores secret data and supported metadata. The README also documents base64 output and request-rate delays. The find implementation and configuration loader were not sampled, so their internal Vault-call wiring is not shown.

Main entry points: [`src/lib/app.rs`](https://github.com/john361/vault-secrets/blob/main/src/lib/app.rs) (Command dispatcher), [`src/lib/vault/business/export.rs`](https://github.com/john361/vault-secrets/blob/main/src/lib/vault/business/export.rs) (Export backup), [`src/lib/vault/business/import.rs`](https://github.com/john361/vault-secrets/blob/main/src/lib/vault/business/import.rs) (Import backup), [`src/lib/vault/client.rs`](https://github.com/john361/vault-secrets/blob/main/src/lib/vault/client.rs) (Vault API client)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["CLI and orchestration"]
  node_runtime["CLI executable<br/>[main.rs]"]
  node_app["Command dispatcher<br/>[app.rs]"]
  node_cli["Command arguments<br/>[cli.rs]"]
end

subgraph group_configuration["Configuration"]
  node_config["App configuration<br/>[config.rs]"]
  node_vaultconfig["Vault settings"]
end

subgraph group_vaultops["Vault operations"]
  node_find["Find secrets<br/>[find.rs]"]
  node_client["Vault API client<br/>[client.rs]"]
end

subgraph group_backups["Backup and encoding"]
  node_export["Export backup<br/>[export.rs]"]
  node_import["Import backup<br/>[import.rs]"]
  node_data["Backup data model<br/>[model.rs]"]
  node_secret["Secret and encryption<br/>[secret.rs]"]
end

node_operator(("Operator or script"))
node_vault["HashiCorp Vault"]
node_files["Backup files"]
node_stdout["Command output"]

node_operator -->|"invokes"| node_runtime
node_runtime -->|"runs"| node_app
node_app -->|"loads arguments"| node_cli
node_app -->|"loads configuration"| node_config
node_config -->|"deserializes settings"| node_vaultconfig
node_app -->|"dispatches find"| node_find
node_app -->|"dispatches export"| node_export
node_app -->|"dispatches import"| node_import
node_find -->|"prints result"| node_stdout
node_export -->|"reads secrets"| node_client
node_export -->|"builds backup records"| node_data
node_export -->|"encrypts backup"| node_secret
node_export -->|"writes backup"| node_files
node_files -->|"supplies backup"| node_import
node_import -->|"decrypts backup"| node_secret
node_import -->|"parses records"| node_data
node_import -->|"restores data and metadata"| node_client
node_client -->|"reads and writes secrets"| node_vault

click node_runtime "https://github.com/john361/vault-secrets/blob/main/src/bin/main.rs"
click node_app "https://github.com/john361/vault-secrets/blob/main/src/lib/app.rs"
click node_cli "https://github.com/john361/vault-secrets/blob/main/src/lib/cli.rs"
click node_config "https://github.com/john361/vault-secrets/blob/main/src/lib/config.rs"
click node_vaultconfig "https://github.com/john361/vault-secrets/tree/main/src/lib/vault/config"
click node_find "https://github.com/john361/vault-secrets/blob/main/src/lib/vault/business/find.rs"
click node_export "https://github.com/john361/vault-secrets/blob/main/src/lib/vault/business/export.rs"
click node_import "https://github.com/john361/vault-secrets/blob/main/src/lib/vault/business/import.rs"
click node_client "https://github.com/john361/vault-secrets/blob/main/src/lib/vault/client.rs"
click node_data "https://github.com/john361/vault-secrets/blob/main/src/lib/vault/model.rs"
click node_secret "https://github.com/john361/vault-secrets/blob/main/src/lib/secret.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_runtime,node_app,node_cli toneBlue
class node_config,node_vaultconfig toneAmber
class node_find,node_client toneMint
class node_export,node_import,node_data,node_secret toneRose
class node_operator,node_vault,node_files,node_stdout toneIndigo
```

## Components

### CLI and orchestration

- [CLI executable](https://github.com/john361/vault-secrets/blob/main/src/bin/main.rs): `src/bin/main.rs`
- [Command dispatcher](https://github.com/john361/vault-secrets/blob/main/src/lib/app.rs): `src/lib/app.rs`
- [Command arguments](https://github.com/john361/vault-secrets/blob/main/src/lib/cli.rs): `src/lib/cli.rs`

### Configuration

- [App configuration](https://github.com/john361/vault-secrets/blob/main/src/lib/config.rs): `src/lib/config.rs`
- [Vault settings](https://github.com/john361/vault-secrets/tree/main/src/lib/vault/config): `src/lib/vault/config`

### Vault operations

- [Find secrets](https://github.com/john361/vault-secrets/blob/main/src/lib/vault/business/find.rs): `src/lib/vault/business/find.rs`
- [Vault API client](https://github.com/john361/vault-secrets/blob/main/src/lib/vault/client.rs): `src/lib/vault/client.rs`

### Backup and encoding

- [Export backup](https://github.com/john361/vault-secrets/blob/main/src/lib/vault/business/export.rs): `src/lib/vault/business/export.rs`
- [Import backup](https://github.com/john361/vault-secrets/blob/main/src/lib/vault/business/import.rs): `src/lib/vault/business/import.rs`
- [Backup data model](https://github.com/john361/vault-secrets/blob/main/src/lib/vault/model.rs): `src/lib/vault/model.rs`
- [Secret and encryption](https://github.com/john361/vault-secrets/blob/main/src/lib/secret.rs): `src/lib/secret.rs`

### Other components

- **Operator or script**
- **HashiCorp Vault**
- **Backup files**
- **Command output**

## Connections

- Operator or script → CLI executable: invokes
- CLI executable → Command dispatcher: runs
- Command dispatcher → Command arguments: loads arguments
- Command dispatcher → App configuration: loads configuration
- App configuration → Vault settings: deserializes settings
- Command dispatcher → Find secrets: dispatches find
- Command dispatcher → Export backup: dispatches export
- Command dispatcher → Import backup: dispatches import
- Find secrets → Command output: prints result
- Export backup → Vault API client: reads secrets
- Export backup → Backup data model: builds backup records
- Export backup → Secret and encryption: encrypts backup
- Export backup → Backup files: writes backup
- Backup files → Import backup: supplies backup
- Import backup → Secret and encryption: decrypts backup
- Import backup → Backup data model: parses records
- Import backup → Vault API client: restores data and metadata
- Vault API client → HashiCorp Vault: reads and writes secrets