KeePass Model¶
omo uses KeePass KDBX4 as the local secrets store. The host maps each entry to a flat map[string]string via entryToSettings and calls the plugin's Configure.
Unlocking¶
| Artifact | Path |
|---|---|
| Database | ~/.omo/secrets/omo.kdbx |
| Key file | ~/.omo/keys/omo.key |
Open in KeePassXC with Key File authentication (no master password by default on first-run vaults).
Hierarchical paths¶
Example: groups redis → production, entry title cache-main → path redis/production/cache-main.
How fields become settings¶
| KeePass field | Settings key(s) |
|---|---|
| Title | name |
| URL | url and host |
| UserName | username |
| Password | password |
| Notes | notes |
| Custom string fields | passed through as-is (port, sslmode, …) |
Empty fields are ignored — only set what the plugin needs.
Per-plugin schemas¶
Exact field lists match pkg/secrets/bootstrap_reference.go and each plugin's *_config.go. See KeePass schemas for the full catalog, and each plugin page.
Common custom attributes:
| Attribute | Plugins |
|---|---|
port |
redis, postgres, ssh |
database |
redis, postgres |
sslmode |
postgres |
amqp_port / mgmt_port / vhost / use_tls |
rabbitmq |
auth_method / key_path / private_key |
ssh |
kubeconfig / context / namespace |
k8s* |
path |
git (local repo) |
region / role_arn |
s3 (region attr); awsCosts uses URL as region |
type |
github (user | org) |
Reference templates¶
On first vault creation, omo seeds <plugin>/default/default_config entries whose Notes document the schema (empty credentials). Inspect with:
CLI vs GUI¶
Both write the same vault.