Secrets and encryption

Two hooks supply the agent server with what it must never store: the value of a secret, from a vault of your own, and the key for end-to-end encryption. Both return a value, and both are called only when the matching setting on the Secrets & encryption page points at them.

Hook	When it is called	The dict holds
`vault`Secrets vault	Before an agent runs, once for each secret the agent reads with `sys.secret`, when the secrets source is `vault`. It returns the value; `None` means the secret does not exist. The agent server keeps a value for the cache period set on the Secrets & encryption page, an hour by default. See Secret vault.	`name`.
`encryptionKey`Encryption key	When the agent server needs a key for end-to-end encryption. It returns the key as 16, 24 or 32 bytes. The Secrets & encryption page calls it once with the current key's name when the settings are saved, and refuses the save when the hook fails or returns anything else. See Encryption.	`keyName`.