credentials

Private host credentials; never included in server settings exports.

bedrock_server_manager.backups.credentials.protect(path: Path, *, directory: bool = False) → None

Restrict a private path to the service identity and host administrators.

bedrock_server_manager.backups.credentials.credentials_directory(config_dir: str | Path) → Path

Return the canonical private directory for all host secret .key files.

bedrock_server_manager.backups.credentials.atomic_bytes(path: Path, data: bytes) → None

Durably replace a private credential file without following its symlink.

bedrock_server_manager.backups.credentials.atomic_json(path: Path, value: Any) → None

Durably replace a private JSON document without following its symlink.

bedrock_server_manager.backups.credentials.locked_credential_file(lock_path: Path, *, busy_message: str = 'Credential store is busy; retry startup.') → Iterator[None]

Serialize initial creation or migration of a private .key file across processes.

class bedrock_server_manager.backups.credentials.KeyRecord(*, key_id: str, created_at: str, secret: SecretStr)

model_config = {'extra': 'forbid'}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class bedrock_server_manager.backups.credentials.KeyStore(*, version: int = 1, active: str | None = None, keys: list[KeyRecord] = <factory>)

model_config = {'extra': 'forbid'}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class bedrock_server_manager.backups.credentials.BackupCredentials(config_dir: str)

Keep old keys available for recovery when rotating the active key.