# function: blindfold

Encrypts base64-encoded plaintext using F5 Distributed Cloud Secret Management (blindfold).

Returns a sealed secret string suitable for use in `blindfold_secret_info.location` fields.

**Security**: The encryption happens locally using the public key fetched from F5XC.
The plaintext secret is **never** transmitted to XCSH during encryption.

## Example

```hcl
resource "xcsh_http_loadbalancer" "example" {
  name = "secure-lb"

  tls_parameters {
    private_key {
      blindfold_secret_info {
        location = provider::xcsh::blindfold(
          base64encode(file("${path.module}/private.key")),
          "example-secret-policy",
          "shared"
        )
      }
    }
  }
}
```

~> **Note:** This function requires Terraform 1.8 or later.

## Signature

<!-- signature generated by tfplugindocs -->

```text
blindfold(plaintext string, policy_name string, namespace string) string
```

## Arguments

<!-- arguments generated by tfplugindocs -->

1. `plaintext` (String) Base64-encoded plaintext to encrypt. Use Terraform's `base64encode()` function for raw strings or file contents.

Example: `base64encode(file("private.key"))`

1. `policy_name` (String) Name of the SecretPolicy that controls which clients can decrypt this secret.

The policy must exist in the specified namespace before encryption.

1. `namespace` (String) XCSH namespace containing the SecretPolicy.

Common values: `shared`, `system`, or your application namespace.

## Example Usage

```terraform
terraform {
  required_version = ">= 1.8"
  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Encrypt a secret string using F5XC blindfold
#
# The blindfold function encrypts base64-encoded plaintext using F5 Distributed
# Cloud Secret Management. The encryption happens locally - your secret is never
# transmitted to F5XC during encryption.

# Example: Encrypt a password for use in origin pool authentication
locals {
  encrypted_password = provider::xcsh::blindfold(
    base64encode("example-secret-password"),
    "production-secrets-policy",
    "shared"
  )
}

# Example: Encrypt a TLS private key from a file
locals {
  encrypted_key = provider::xcsh::blindfold(
    base64encode(file("${path.module}/certs/private.key")),
    "tls-secrets-policy",
    "shared"
  )
}

# Example: Using the encrypted secrets in a resource
resource "xcsh_origin_pool" "example" {
  name      = "secure-pool"
  namespace = "production"

  origin_servers {
    private_ip {
      ip = "10.0.0.1"
    }
  }

  port = 443

  # Use the encrypted password from locals
  custom_hash_algorithms {
    hash_algorithms = [local.encrypted_password]
  }
}

resource "xcsh_http_loadbalancer" "example" {
  name      = "secure-lb"
  namespace = "production"

  domains = ["example.com"]

  https_auto_cert {
    tls_config {
      custom_security {
        private_key {
          blindfold_secret_info {
            location = local.encrypted_key
          }
        }
      }
    }
  }
}
```

## See Also

- [F5XC Secret Management Documentation](https://docs.cloud.f5.com/docs/how-to/advanced-security/blindfold-your-tls-certificates)