JSON database encryption

[andryyy]

Data is stored and replicated using JSON files. Yes, kill me, but with a good locking mechanism over multiple nodes (and procs, and threads, ...) it works great, is easy to revert, backup, and fix.

Since we store credentials in these files and even though the file is only readable by a new, unprivileged user, it feels dirty.

These files exist on the "app nodes" as well as on the "worker nodes". An app node should never be available from external sources so I'm okay with the status quo.

A worker node will carry a copy of its relevant data only while being accessible on the public network.

I thought about providing a password while deploying the worker. We can pass it to the podman container using stdin. Something like podman run -t --name stdin -d bash:latest bash -c 'read X ; echo You said $X' followed by echo EHLO | podman attach stdin but via API.

Storing the data or password in a secret does not prevent reading it...