secure variable server configuration

command/agent/config.go

@@ -431,6 +431,19 @@ type ServerConfig struct {
 	// GCed but the threshold can be used to filter by age.
 	CSIPluginGCThreshold string `hcl:"csi_plugin_gc_threshold"`
 
+	// RootKeyGCInterval is how often we dispatch a job to GC
+	// encryption key metadata
+	RootKeyGCInterval string `hcl:"root_key_gc_interval"`
+
+	// RootKeyGCThreshold is how "old" encryption key metadata must be
+	// to be eligible for GC.
+	RootKeyGCThreshold string `hcl:"root_key_gc_threshold"`
+
+	// RootKeyRotationThreshold is how "old" an encryption key must be
+	// before it is automatically rotated on the next garbage
+	// collection interval.
+	RootKeyRotationThreshold string `hcl:"root_key_rotation_threshold"`
+
 	// HeartbeatGrace is the grace period beyond the TTL to account for network,
 	// processing delays and clock skew before marking a node as "down".
 	HeartbeatGrace    time.Duration
@@ -1526,6 +1539,15 @@ func (s *ServerConfig) Merge(b *ServerConfig) *ServerConfig {
 	if b.CSIPluginGCThreshold != "" {
 		result.CSIPluginGCThreshold = b.CSIPluginGCThreshold
 	}
+	if b.RootKeyGCInterval != "" {
+		result.RootKeyGCInterval = b.RootKeyGCInterval
+	}
+	if b.RootKeyGCThreshold != "" {
+		result.RootKeyGCThreshold = b.RootKeyGCThreshold
+	}
+	if b.RootKeyRotationThreshold != "" {
+		result.RootKeyRotationThreshold = b.RootKeyRotationThreshold
+	}
 	if b.HeartbeatGrace != 0 {
 		result.HeartbeatGrace = b.HeartbeatGrace
 	}

nomad/encrypter.go

@@ -476,8 +476,6 @@ START:
 	}
 
 ERR_WAIT:
-	// TODO: what's the right amount of backoff here? should this be
-	// part of our configuration?
 	retryErrTimer.Reset(1 * time.Second)
 
 	select {

nomad/server.go

@@ -386,7 +386,14 @@ func NewServer(config *Config, consulCatalog consul.CatalogAPI, consulConfigEntr
 	}
 
 	// Set up the keyring
-	encrypter, err := NewEncrypter(s, filepath.Join(s.config.DataDir, "keystore"))
+	keystorePath := filepath.Join(s.config.DataDir, "keystore")
+	if s.config.DevMode && s.config.DataDir == "" {
+		keystorePath, err = os.MkdirTemp("", "nomad-keystore")
+		if err != nil {
+			return nil, fmt.Errorf("Failed to create keystore tempdir")
+		}
+	}
+	encrypter, err := NewEncrypter(s, keystorePath)
 	if err != nil {
 		return nil, err
 	}