Skip to main content

Encryption

DIAL Core uses AES encryption for the prefix of each bucket in blob storage, which is how it addresses resources there. These two static settings supply the values that encryption uses. This page is for platform engineers who generate and store Core's secrets.

Settings​

SettingDefaultDescription
encryption.secret—The secret used for AES encryption of the bucket prefix in blob storage. Use a randomly generated string.
encryption.key—The key used for AES encryption of the bucket prefix in blob storage. Use a randomly generated string.

Changing either value changes bucket addressing and can make existing resources inaccessible, so set them once, keep them stable, and back them up with your blob storage. Encryption of toolset credentials is configured separately, in Toolsets security.

Example​

In Docker Compose, inject the values from the .env file:

{
  "encryption": {
    "secret": "${DIAL_CORE_ENCRYPTION_SECRET}",
    "key": "${DIAL_CORE_ENCRYPTION_KEY}"
  }
}

In production, keep both values in a secret manager. See Secrets management and the .env reference.

Further reading​