Skip to content

Commit

Permalink
Update docs/docs/30-administration/40-encryption.md
Browse files Browse the repository at this point in the history
  • Loading branch information
anbraten authored and zc-devs committed Aug 29, 2023
1 parent ae2ccd3 commit f4ef1e8
Showing 1 changed file with 6 additions and 6 deletions.
12 changes: 6 additions & 6 deletions docs/docs/30-administration/40-encryption.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Secrets encryption

By default, Woodpecker does not encrypt secrets in its database. You can enable encryption
using simple AES key.
using a simple AES key.

:::caution
Secrets encryption is experimental.
Expand Down Expand Up @@ -29,19 +29,19 @@ You can manage encryption on server using these environment variables:
- `WOODPECKER_ENCRYPTION_KEY` - encryption key
- `WOODPECKER_ENCRYPTION_KEY_FILE` - file to read encryption key from

One option to generate encryption key is to use OpenSSL, but any password generator can be used also. Recommended length is at least 32 bytes:
One option to generate encryption key is to use OpenSSL, but any password generator can also be used. Recommended key length is at least 32 bytes:
```shell
$ openssl rand -base64 32
GjVHT007c4x3N+YPbsZld+hifba1enXkOzIb/0h6oW8=
```

If we run server with `WOODPECKER_ENCRYPTION_KEY='GjVHT007c4x3N+YPbsZld+hifba1enXkOzIb/0h6oW8='`, and try to create secret `some_secret:super-secret-value`
then we'll get messages in log similar to:
If we run the server with `WOODPECKER_ENCRYPTION_KEY='GjVHT007c4x3N+YPbsZld+hifba1enXkOzIb/0h6oW8='`, and try to create a secret like `some_secret:super-secret-value`
then we'll get messages in the log similar to:
```log
{"level":"debug","id":0,"name":"some_secret","time":"2023-08-20T19:37:42Z","caller":"/woodpecker/server/plugins/secrets/encrypted.go:219","message":"encryption"}
{"level":"debug","id":9,"name":"some_secret","time":"2023-08-20T19:37:42Z","caller":"/woodpecker/server/plugins/secrets/encrypted.go:230","message":"decryption"}
```
and row in database similar to:
and a row in the database similar to:
```psql
woodpecker=# select secret_id, secret_name, secret_value from secrets;
secret_id | secret_name | secret_value
Expand All @@ -51,5 +51,5 @@ woodpecker=# select secret_id, secret_name, secret_value from secrets;
```

:::note
You won't get exactly the same secret's encrypted value because random nonce is used.
You won't get exactly the same secret's encrypted value, because a random nonce is used.
:::

0 comments on commit f4ef1e8

Please sign in to comment.