mirrors/garage
1
0
Fork 0
mirror of https://git.deuxfleurs.fr/Deuxfleurs/garage.git synced 2024-11-22 08:01:02 +00:00
Code Issues Projects Releases Packages Wiki Activity

doc: encryption organization

Browse source
This commit is contained in:
Alex Auvolat 2023-06-14 12:51:47 +02:00
parent 120f8b3bfb
commit 9092c71a01
1 changed files with 10 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
doc/book/cookbook/encryption.md
View file

@ -49,14 +49,9 @@ implements a protocol that has been clearly reviewed, Secure ScuttleButt's
Secret Handshake protocol. This is why setting a `rpc_secret` is mandatory, Secret Handshake protocol. This is why setting a `rpc_secret` is mandatory,
and that's also why your nodes have super long identifiers. and that's also why your nodes have super long identifiers.
## Encrypting traffic between a Garage node and your client ## HTTP API endpoints provided by Garage are in clear text
HTTP API endpoints provided by Garage are in clear text. Adding TLS support built into Garage is not currently planned.
You have multiple options to have encryption between your client and a node:
- Setup a reverse proxy with TLS / ACME / Let's encrypt
- Setup a Garage gateway locally, and only contact the garage daemon on `localhost`
- Only contact your Garage daemon over a secure, encrypted overlay network such as Wireguard
## Garage stores data in plain text on the filesystem ## Garage stores data in plain text on the filesystem
@ -76,6 +71,14 @@ system such as Hashicorp Vault?
# Adding data encryption using external tools # Adding data encryption using external tools
## Encrypting traffic between a Garage node and your client
You have multiple options to have encryption between your client and a node:
- Setup a reverse proxy with TLS / ACME / Let's encrypt
- Setup a Garage gateway locally, and only contact the garage daemon on `localhost`
- Only contact your Garage daemon over a secure, encrypted overlay network such as Wireguard
## Encrypting data at rest ## Encrypting data at rest
Protects against the following threats: Protects against the following threats: