[Task]: Encryption Configuration in Config TOML

[renuka-fernando]

Please select the area the issue is related to

Area/Management (Management API or Management Portal UI)

Please select the aspect the issue is related to

Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI)

Description

Rethink the Config for Encryption

// Database holds database-specific configuration.
type Database struct {
	// Driver supports: sqlite3, postgres/postgresql/pgx, sqlserver/mssql.
	Driver string `koanf:"driver"`
	// Path is the file path for SQLite databases.
	Path            string `koanf:"path"`
	Host            string `koanf:"host"`
	Port            int    `koanf:"port"`
	Name            string `koanf:"name"`
	User            string `koanf:"user"`
	Password        string `koanf:"password"`
	SSLMode         string `koanf:"ssl_mode"`
	MaxOpenConns    int    `koanf:"max_open_conns"`
	MaxIdleConns    int    `koanf:"max_idle_conns"`
	ConnMaxLifetime int    `koanf:"conn_max_lifetime"`

	EncryptionKey                  string `koanf:"encryption_key"`
	SubscriptionTokenEncryptionKey string `koanf:"subscription_token_encryption_key"`
	SecretEncryptionKey            string `koanf:"secret_encryption_key"`
	// SecretKeyFile is the path to a 32-byte binary key file used for secret encryption.
	// Honoured in both demo and non-demo mode when neither SecretEncryptionKey nor
	// EncryptionKey is set. In demo mode the file is auto-generated on first startup and
	// reused on subsequent restarts; in non-demo mode the file must already exist (a missing
	// or unreadable file is fatal). Matches the gateway controller key-management pattern.
	SecretKeyFile string `koanf:"secret_key_file"`
}

Only SecretEncryptionKey is supported via file (all the above encryption keys should support it)

Or a shared encryption key.

[thivindu]

Update

Based on the discussions with @renuka-fernando, @Krishanx92 and @malinthaprasan we have decided to go with 2 separate keys for encrypting internal (signing/encryption) and external (signing/encryption) sensitive data. See #2553 (comment).

Therefore the Database.EncryptionKey, Database.SubscriptionTokenEncryptionKey and Database.SecretEncryptionKey will be replaced by a single EncryptionKey config at the root level of the configuration. No changes to Auth.JWT.SecretKey.

Old field	Old env var	Purpose	New field	New env var
Database.EncryptionKey	DATABASE_ENCRYPTION_KEY	shared fallback for encrypted DB columns	EncryptionKey	ENCRYPTION_KEY
Database.SubscriptionTokenEncryptionKey	DATABASE_SUBSCRIPTION_TOKEN_ENCRYPTION_KEY	subscription-token encryption	EncryptionKey	ENCRYPTION_KEY
Database.SecretEncryptionKey (+ …KeyFile)	PLATFORM_SECRET_ENCRYPTION_KEY / DATABASE_SECRET_ENCRYPTION_KEY_FILE	secret vault	EncryptionKey	ENCRYPTION_KEY
Auth.JWT.SecretKey	AUTH_JWT_SECRET_KEY	HS256 login-JWT signing (+ silent encryption fallback)	Auth.JWT.SecretKey	AUTH_JWT_SECRET_KEY

Related discussions

• [Proposal] `{{ env }}` / `{{ file }}` interpolation in gateway `config.toml` #1983

[thivindu]

Fixed via - #2553