Mithril — Config — The Vaults




Purpose
🔐
Credential encryption (Argon2id + AES-256-GCM), provider settings, permission ma
Files
1
LOC
467

Key Concept

API keys are encrypted at rest. In Docker, env vars (MITHRIL_KEY_) take priority over encrypted file.

Encryption at Rest

API keys are never stored in plaintext. The encryption chain:

  1. User runs mithril config set gemini "AIza..."
  2. A random salt is generated
  3. Argon2id derives an encryption key from the salt (+ optional user password)
  4. AES-256-GCM encrypts the API key
  5. The encrypted blob + salt are stored in ~/.mithril/config.yaml

Docker/CI: Environment Variables

In Docker, credentials come from environment variables (no file encryption needed):

Priority: env var → encrypted file. Env vars always win.

Permission System

Tools can be configured as:

FilePurpose
mod.rsConfiguration management with Argon2id-derived AES-256-GCM credentials.