Encrypting your data

This example is shown using etcd, but any of the supported backends should work.

Creating PGP keys

crypt, unlike gpg, requires your keypair to be in ASCII armor format. For the purpose of this example you can use the pair provided below, or you can create your own.

Using my sample key pair (unsafe for anything other than local testing)

save the following as .pubring.gpg

save the following as .secring.gpg

Generating your own key pair

$ cat << EOF > app.batch
%echo Generating a configuration OpenPGP key
Key-Type: default
Subkey-Type: default
Name-Real: app
Name-Comment: app configuration key
Name-Email: app@example.com
Expire-Date: 0
%pubring .pubring.gpg
%secring .secring.gpg
%commit
%echo done
EOF
$ gpg2 --batch --armor --gen-key app.batch

Encrypting and storing your data

There are many ways of doing this as long as the input data follows the following format, base64(gpg(gzip(data))). Below are two ways to get you going quickly, the first using plain old gpg and second using the crypt cli utility (which is not the same as man 3 crypt).

Storing data using gpg(2)

$ mkdir -p ~/tmp/gpg # so we don't interfere with any current pgp keys
$ chmod 700 ~/tmp/gpg
$ gpg2 --homedir ~/tmp/gpg --import .pubring.gpg
$ export TEST_RECIPIENT=76FA75BF # if you used my key from above
$ export TEST_RECIPIENT="$(gpg2 --homedir ~/tmp/gpg --list-keys\
  | grep 'pub '\
  | cut -f2 -d/\
  | cut -f1 -d' ')" # if you generated your own keypair
$ curl\
  --location\
  --request PUT\
  --data-urlencode value="$(echo 'secret text'\
   | gzip -c\
   | gpg2 --homedir ~/tmp/gpg\
      --compress-level 0\
      --encrypt\
      --default-recipient ${TEST_RECIPIENT}\
   | base64)"\
  http://127.0.0.1:4001/v2/keys/secret/test1
# - or if you have etcdctl -
$ echo 'secret text'\
  | gzip -c\
  | gpg2 --homedir ~/tmp/gpg\
     --compress-level 0\
     --encrypt\
     --default-recipient ${TEST_RECIPIENT}\
  | base64\
  | etcdctl set /secret/test1

Storing data using `crypt`

$ go get github.com/xordataexchange/crypt/bin/crypt
$ crypt set /secret/test1 /path/to/secret-file.txt
# - or -
$ crypt set /secret/test1 <(echo "secret text")

Verify your encrypted data

You should see your base64 encrypted data here

$ curl http://127.0.0.1:4001/v2/keys/secret/test1
# - or -
$ etcdctl get /secret/test1

Get crypt if you haven't done so already.

$ go get github.com/xordataexchange/crypt/bin/crypt

The following will print your decrypted text to stdout.

$ crypt get /secret/test1

Putting it all together, using with confd

Now that we've verified we can put encrypted data in your datastore, lets have confd extract it into a template.

$ mkdir ~/tmp/confd-config/{conf.d,templates}
$ cat << EOF > ~/tmp/confd-config/conf.d/secret.toml
[template]
prefix = "/secret"
src = "secret.tmpl"
dest = "/tmp/secret.txt"
keys = [
  "/test1"
]
EOF
$ cat << EOF > ~/tmp/confd-config/templates/secret.tmpl
your secret value is: {{ cgetv "/test1" }}

and again with the key here:
{{with cget "/test1"}}
    key: {{.Key}}
    value: {{.Value}}
{{end}}

and here again in a loop:
{{range cgets "/*"}}
    key: {{.Key}}
    value: {{.Value}}
{{end}}

and again in another loop:
{{range cgetvs "/*"}}
    value: {{.}}
{{end}}
EOF
$ confd -node=http://127.0.0.1:4001 -secret-keyring=/path/to/.secring.gpg -confdir ~/tmp/confd-config -interval 2

Now take a look at /tmp/secret.txt.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

data_encryption.md

data_encryption.md

Encrypting your data

Creating PGP keys

Using my sample key pair (unsafe for anything other than local testing)

Generating your own key pair

Encrypting and storing your data

Storing data using gpg(2)

Storing data using `crypt`

Verify your encrypted data

Putting it all together, using with confd

Files

data_encryption.md

Latest commit

History

data_encryption.md

File metadata and controls

Encrypting your data

Creating PGP keys

Using my sample key pair (unsafe for anything other than local testing)

Generating your own key pair

Encrypting and storing your data

Storing data using gpg(2)

Storing data using crypt

Verify your encrypted data

Putting it all together, using with confd

Storing data using `crypt`