File Secret Storage Provider
File Secret Storage Provider keeps an Agent-local vault file whose secret payloads are encrypted at rest. It is a backing provider for Secret Manager, not a general file-sharing component.
Create a local vault with a recoverable operating model
On first start, the provider creates a vault under the Agent application configuration folder in its secrets directory when Create if missing is enabled. The vault name is the configured file name with a .vault extension; when no name is supplied, the Thing UUID becomes the file name.
Choose a protected host location
The vault is local to the Agent. Protect the host, Agent configuration directory and backup destination with operating-system access controls.
Set and preserve the master password
The password opens the vault and encrypts secret payloads. Store recovery information in the organisation’s approved password-management process; a lost password cannot be used to decrypt an existing vault.
Connect Secret Manager
Start this provider, then select it in Secret Manager.
Configuration parameters
| Parameter | Required | Description | Default |
|---|---|---|---|
Title | Yes | Display name of the provider. | File Secret Storage |
Master password | Yes | Password that opens the vault and encrypts/decrypts secret payloads. Changing it restarts the provider; it must match an existing vault. | None |
Vault file name | Optional | File name under the Agent’s secrets folder. The .vault suffix is added when absent. | Thing UUID |
Create if missing | Yes | Creates a new empty vault if the configured file does not exist. Disable when an existing vault must be present. | Enabled |
Encrypt payloads, retain useful metadata
Each secret payload is encrypted with AES-256-GCM before it is written to the vault. Alias, type, display name, description, format and update time remain available as metadata so Secret Manager can list entries without exposing their values. The provider uses an atomic replace when saving the vault file to avoid leaving a partially written target file during a normal write.
Local boundary
The vault remains on the Agent host and is not an upload target for Portal metadata.
Encrypted payload
Secret values are ciphertext at rest; protecting the master password and host is still essential.
Visible metadata
Choose aliases and descriptions that are operationally useful but do not disclose sensitive details.
Back up the vault and its recovery path
Protect both parts
A vault backup without the master password is not a recovery plan; a password without the vault is not a secret backup. Keep both under separate, approved controls.
Disable accidental creation
For a production recovery vault, disable Create if missing. A wrong file name should fail startup rather than create a second empty vault.
Do not use file copying as rotation
Rotate credentials through Secret Manager, validate consumers, and keep a tested backup procedure. Do not edit the vault file manually.
Plan restarts
Changing the master password, file name or creation policy restarts the provider. Dependent Secret Manager instances and consumers should be validated after the change.