Skip to main content

AFS_AETHER_LOG_REDACT

Deep-dive reference for:

  • AFS_AETHER_LOG_REDACT

Status​

  • active

Audience​

  • production/user

Type and Default​

  • Type: string enum.
  • Accepted values: off, hash (case-insensitive in env input).
  • Default: hash (with no salt unless configured).

What It Does​

Controls whether selected sensitive log fields are emitted raw or hashed.

  • off: sensitive fields are emitted as-is.
  • hash: sensitive fields are replaced with SHA-256 hashes.

Input Surfaces​

  • Env: AFS_AETHER_LOG_REDACT=<off|hash>
  • Config file (aether.toml):
    • [logging] redaction = "off" or [logging] redaction = "hash"

There is currently no dedicated CLI flag for log redaction mode.

Resolution and Override Order​

  1. Built-in default (hash with salt=None)
  2. aether.toml ([logging].redaction)
  3. Environment (AFS_AETHER_LOG_REDACT)

What Gets Redacted​

Redaction is field-name based (case-insensitive). The current sensitive field set is:

  • path
  • target_path
  • link_path
  • xattr_name
  • token
  • auth_token
  • authorization
  • session_token
  • secret
  • request_path

Only values recorded under those field names are transformed.

Important Limitation​

AFS_AETHER_LOG_REDACT does not automatically sanitize arbitrary free-form message text. If sensitive values are embedded directly in message strings, they can still appear in logs.

Salt Interaction​

  • AFS_AETHER_LOG_REDACT_SALT provides optional hash salt.
  • If salt is set while redaction mode is off, config logic promotes mode to hash with that salt.

Reload Behavior (SIGHUP)​

log_redaction changes are detected on config reload, but are not hot-applied. The process logs a restart-required warning; changes take effect after restart.

Validation​

  • Invalid env values fail config load with:
    • unknown redaction mode '<value>'

Examples​

  • Disable redaction:
    • AFS_AETHER_LOG_REDACT=off aether mount --session-id s1 --mount-dir /mnt/aether
  • Enable hashed redaction:
    • AFS_AETHER_LOG_REDACT=hash aether mount --session-id s1 --mount-dir /mnt/aether
  • Enable hashed redaction with salt:
    • AFS_AETHER_LOG_REDACT=hash AFS_AETHER_LOG_REDACT_SALT=team-secret aether mount --session-id s1 --mount-dir /mnt/aether
  • AFS_AETHER_LOG_REDACT_SALT
  • AFS_AETHER_LOG_FORMAT
  • AFS_AETHER_LOG

Primary Implementation Sources​

  • packages/aether/src/config/types/model_defaults.rs
  • packages/aether/src/config/types/apply_env.rs
  • packages/aether/src/config/types/file_config_loader.rs
  • packages/aether/src/observability/logging.rs
  • packages/aether/src/config/reload.rs