Features

Encrypted Secrets Management

• AES-256-GCM encryption for secrets stored in MongoDB
• Master key derived using PBKDF2 with 100,000 iterations
• Secrets decrypted in-memory only before container launch
• Runtime injection via --env-file (not baked into image layers)
• REST API endpoints for secret CRUD operations
• Authorization: Only project owners and admins can manage secrets
• Never expose decrypted values in API responses

Persistent Volumes

• Automatic volume creation for each project deployment
• Volumes mounted at /app/data inside containers
• Automatic cleanup when projects are deleted
• Volume metadata tracked in MongoDB

Encryption

• Secrets encrypted at rest in database
• Master key provided via SECRET_MASTER_KEY environment variable
• No plaintext secrets in logs, image layers, or on disk
• Authorization checks on all secret operations
• Input validation and size limits on secret payloads

Changes

Backend

• New: src/backend/utils/encryption.ts - AES-256-GCM encryption service
• New: src/backend/utils/authorization.ts - Project access verification
• New: src/backend/secrets.ts - Secret management API routes
• New: src/backend/shell_scripts/volume.sh - Volume management script
• Modified: src/backend/db.ts - Added secrets and volume metadata functions
• Modified: src/backend/server.ts - Added routes and encryption initialization
• Modified: src/backend/scripts.ts - Integrated volumes and secrets into deployment
• Modified: src/backend/shell_scripts/container.sh - Volume mounting and env injection
• Modified: src/backend/shell_scripts/delete.sh - Volume cleanup on deletion

Frontend

• New: src/frontend/src/utils/secrets.ts - Secret API client
• New: src/frontend/src/components/SecretManager.vue - Secret management UI

Tests

• New: src/backend/utils/encryption.test.ts - Comprehensive encryption service tests

API Endpoints

Create/Update Secrets

POST /secrets/:subdomain
Body: { secrets: { key: value }, token: string, provider: string }

List Secret Keys

GET /secrets/:subdomain?token={jwt}&provider={provider}
Response: { keys: string[], hasSecrets: boolean, keysCount: number }

Delete Secrets

DELETE /secrets/:subdomain
Body: { token: string, provider: string }

Environment Variables

Required (for secrets feature)

• SECRET_MASTER_KEY: Master encryption key (32+ characters)

Database Collections

New Collections

• project_secrets: Encrypted secrets with IV and authentication tags
• volume_metadata: Volume tracking information

Required Setup

1. Set SECRET_MASTER_KEY in backend .env file (minimum 32 characters)
2. Restart backend container to initialize encryption service
3. MongoDB collections will be created automatically on first use

Testing

Run tests:

deno test src/backend/utils/encryption.test.ts --allow-all

Closes #45