github/woodpecker
1
0
Fork 0
mirror of https://github.com/woodpecker-ci/woodpecker.git synced 2025-10-22 00:24:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Secrets encryption in database (#1475)

Browse Source 
closes #101

Added secrets encryption in database

- Google TINK or simple AES as encryption mechanisms
- Keys rotation support on TINK
- Existing SecretService is wrapped by encryption layer
- Encryption can be enabled and disabled at any time

Co-authored-by: Kuzmin Ilya <ilia.kuzmin@indrive.com>
Co-authored-by: 6543 <6543@obermui.de>
This commit is contained in:
antomy-gc
2023-01-12 22:59:07 +03:00
committed by GitHub
parent f71142d162
commit 6516a28cdd
31 changed files with 1633 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
cmd/server/flags.go
View File

@@ -525,4 +525,23 @@ var flags = []cli.Flag{
Hidden: true,
// TODO(485) temporary workaround to not hit api rate limits
},
//
// secrets encryption in DB
//
&cli.StringFlag{
EnvVars: []string{"WOODPECKER_ENCRYPTION_KEY"},
Name: "encryption-raw-key",
Usage: "Raw encryption key",
FilePath: os.Getenv("WOODPECKER_ENCRYPTION_KEY_FILE"),
},
&cli.StringFlag{
EnvVars: []string{"WOODPECKER_ENCRYPTION_TINK_KEYSET_FILE"},
Name: "encryption-tink-keyset",
Usage: "Google tink AEAD-compatible keyset file to encrypt secrets in DB",
},
&cli.BoolFlag{
EnvVars: []string{"WOODPECKER_ENCRYPTION_DISABLE"},
Name: "encryption-disable-flag",
Usage: "Flag to decrypt all encrypted data and disable encryption on server",
},
}

11
cmd/server/server.go
View File

@@ -44,6 +44,8 @@ import (
"github.com/woodpecker-ci/woodpecker/server/logging"
"github.com/woodpecker-ci/woodpecker/server/model"
"github.com/woodpecker-ci/woodpecker/server/plugins/config"
"github.com/woodpecker-ci/woodpecker/server/plugins/encryption"
encryptedStore "github.com/woodpecker-ci/woodpecker/server/plugins/encryption/wrapper/store"
"github.com/woodpecker-ci/woodpecker/server/pubsub"
"github.com/woodpecker-ci/woodpecker/server/router"
"github.com/woodpecker-ci/woodpecker/server/router/middleware"
@@ -260,6 +262,13 @@ func setupEvilGlobals(c *cli.Context, v store.Store, f forge.Forge) {
// forge
server.Config.Services.Forge = f
// encryption
encryptedSecretStore := encryptedStore.NewSecretStore(v)
err := encryption.Encryption(c, v).WithClient(encryptedSecretStore).Build()
if err != nil {
log.Fatal().Err(err).Msg("could not create encryption service")
}
// services
server.Config.Services.Queue = setupQueue(c, v)
server.Config.Services.Logs = logging.New()
@@ -268,7 +277,7 @@ func setupEvilGlobals(c *cli.Context, v store.Store, f forge.Forge) {
log.Error().Err(err).Msg("could not create pubsub service")
}
server.Config.Services.Registries = setupRegistryService(c, v)
server.Config.Services.Secrets = setupSecretService(c, v)
server.Config.Services.Secrets = setupSecretService(c, encryptedSecretStore)
server.Config.Services.Environ = setupEnvironService(c, v)
server.Config.Services.Membership = setupMembershipService(c, f)

2
cmd/server/setup.go
View File

@@ -164,7 +164,7 @@ func setupQueue(c *cli.Context, s store.Store) queue.Queue {
return queue.WithTaskStore(queue.New(c.Context), s)
}
func setupSecretService(c *cli.Context, s store.Store) model.SecretService {
func setupSecretService(c *cli.Context, s model.SecretStore) model.SecretService {
return secrets.New(c.Context, s)
}