#Encryption (Key Management)

monetr supports encrypting secrets before they are stored in PostgreSQL. Other data may support encryption in the future but at the moment only Plaid credentials are encrypted.

To that end, monetr supports a few different providers. An outline of the configuration for key management:

keyManagement:
  provider: "<plaintext|aws|openbao|vault>" # KMS provider, must be one of these values
  aws: { ... }     # AWS KMS specific configuration, only used when `provider: aws`
  openbao: { ... } # OpenBao specific configuration, only used when `provider: openbao`
  vault: { ... }   # Hashicorp Vault configuration, only used when `provider: vault`

#Plaintext

When plaintext is specified as the provider, monetr will not encrypt any secrets and all items in the secrets table will be stored in plain text. This is fine for self hosted deployments or development environments.

#AWS KMS Configuration

The AWS KMS will encrypt secrets using AWS's key management API. There is also an option to run a local version of AWS KMS for the local development environment for monetr.

keyManagement:
  aws:
    region: "us-east1"
    accessKey: "..."
    secretKey: "..."
    keyID: "..."
    endpoint: "..." # Only used in development, but can still be specified if you want.

#OpenBao Transit Configuration

OpenBao is a self-hostable option for encryption. OpenBao keeps track of the encryption keys themselves while monetr leverages the Transit secrets engine to encrypt and decrypt data.

When running inside Kubernetes, monetr can use the kubernetes authentication method to access OpenBao. When this is configured, monetr will automatically renew its OpenBao credentials a few moments before they expire. Other authentication methods may require a non-expiring token such as the root token.

keyManagement:
  openbao:
    keyID: monetr
    authMethod: kubernetes
    role: monetr
    endpoint: https://your-openbao-server.local:8200
    tlsCertificatePath: /etc/monetr/openbao/tls.crt
    tlsKeyPath: /etc/monetr/openbao/tls.key
    tlsCAPath: /etc/monetr/openbao/ca.crt
    insecureSkipVerify: false

#Vault Transit Configuration

Hashicorp Vault is a self-hostable option for encryption. Vault keeps track of the encryption keys themselves while monetr leverages the Transit secrets engine to encrypt and decrypt data.

When running inside Kubernetes, monetr can use the kubernetes authentication method to access Vault. When this is configured, monetr will automatically renew its Vault credentials a few moments before they expire. Other authentication methods may require a non-expiring token such as the root token.

keyManagement:
  vault:
    keyID: monetr
    authMethod: kubernetes
    role: monetr
    endpoint: https://your-vault-server.local:8200
    tlsCertificatePath: /etc/monetr/vault/tls.crt
    tlsKeyPath: /etc/monetr/vault/tls.key
    tlsCAPath: /etc/monetr/vault/ca.crt
    insecureSkipVerify: false

#Related Topics