Mirrors/woodpecker
1
0
Fork 0
mirror of https://github.com/woodpecker-ci/woodpecker.git synced 2026-03-16 01:19:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

Secrets encryption in database (#1475)

Browse Source 
closes #101

Added secrets encryption in database

- Google TINK or simple AES as encryption mechanisms
- Keys rotation support on TINK
- Existing SecretService is wrapped by encryption layer
- Encryption can be enabled and disabled at any time

Co-authored-by: Kuzmin Ilya <ilia.kuzmin@indrive.com>
Co-authored-by: 6543 <6543@obermui.de>
This commit is contained in:
antomy-gc
2023-01-12 22:59:07 +03:00
committed by GitHub
parent f71142d162
commit 6516a28cdd
31 changed files with 1633 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
cmd/server/server.go
View File

@@ -44,6 +44,8 @@ import (
"github.com/woodpecker-ci/woodpecker/server/logging"
"github.com/woodpecker-ci/woodpecker/server/model"
"github.com/woodpecker-ci/woodpecker/server/plugins/config"
"github.com/woodpecker-ci/woodpecker/server/plugins/encryption"
encryptedStore "github.com/woodpecker-ci/woodpecker/server/plugins/encryption/wrapper/store"
"github.com/woodpecker-ci/woodpecker/server/pubsub"
"github.com/woodpecker-ci/woodpecker/server/router"
"github.com/woodpecker-ci/woodpecker/server/router/middleware"
@@ -260,6 +262,13 @@ func setupEvilGlobals(c *cli.Context, v store.Store, f forge.Forge) {
// forge
server.Config.Services.Forge = f
// encryption
encryptedSecretStore := encryptedStore.NewSecretStore(v)
err := encryption.Encryption(c, v).WithClient(encryptedSecretStore).Build()
if err != nil {
log.Fatal().Err(err).Msg("could not create encryption service")
}
// services
server.Config.Services.Queue = setupQueue(c, v)
server.Config.Services.Logs = logging.New()
@@ -268,7 +277,7 @@ func setupEvilGlobals(c *cli.Context, v store.Store, f forge.Forge) {
log.Error().Err(err).Msg("could not create pubsub service")
}
server.Config.Services.Registries = setupRegistryService(c, v)
server.Config.Services.Secrets = setupSecretService(c, v)
server.Config.Services.Secrets = setupSecretService(c, encryptedSecretStore)
server.Config.Services.Environ = setupEnvironService(c, v)
server.Config.Services.Membership = setupMembershipService(c, f)